fix generation of certIssuingPermissions

tools/itscertgen/asn1certgen/asn1certgen.xslt

@@ -130,9 +130,13 @@
    <xsl:apply-templates mode="region" select="../validity/restriction[@type='region']"/>
    <xsl:apply-templates select="attribute[@type='assurance_level']"/>
    <xsl:apply-templates select="attribute[@type='its_aid_ssp_list']"/>
-   <xsl:apply-templates select="attribute[@type='its_aid_list']">
-    <xsl:with-param name="certType" select="@type"/>
-   </xsl:apply-templates>
+   <xsl:if test="attribute[@type='its_aid_list']">
+    <certIssuePermissions>
+     <xsl:apply-templates select="attribute[@type='its_aid_list']">
+      <xsl:with-param name="certType" select="@type"/>
+     </xsl:apply-templates>
+    </certIssuePermissions>
+   </xsl:if>
    <xsl:apply-templates select="attribute[@type='encryption_key']"/>
    <xsl:apply-templates select="attribute[@type='verification_key']"/>
   </toBeSigned>
@@ -160,7 +164,6 @@
  
  <xsl:template match="attribute[@type='its_aid_list']">
   <xsl:param name="certType"/>
-  <certIssuePermissions>
    <PsidGroupPermissions>
     <subjectPermissions>
      <explicit>
@@ -171,10 +174,9 @@
     </subjectPermissions>
     <minChainLength>
      <xsl:choose>
+      <xsl:when test="@minChainLength"><xsl:value-of select="@minChainLength"/></xsl:when>
       <xsl:when test="$certType = 'ROOT'">2</xsl:when>
-      <xsl:when test="$certType = 'AA'">1</xsl:when>
-      <xsl:when test="$certType = 'EA'">1</xsl:when>
-      <xsl:otherwise>0</xsl:otherwise>
+      <xsl:otherwise>1</xsl:otherwise>
      </xsl:choose>
     </minChainLength>
     <chainLengthRange>
@@ -188,13 +190,15 @@
       <xsl:when test="@eeType = 'enrol'">
         <xsl:text>01000000</xsl:text>
       </xsl:when>
-      <xsl:otherwise>
+      <xsl:when test="@eeType = 'app'">
         <xsl:text>10000000</xsl:text>
+      </xsl:when>
+      <xsl:otherwise>
+        <xsl:text>11000000</xsl:text>
       </xsl:otherwise>
      </xsl:choose>
     </eeType>
    </PsidGroupPermissions>
-  </certIssuePermissions>
  </xsl:template>
  
  <xsl:template mode="certIssuePermissions" match="aid">