fix minchainlength in root certs

certgen/asn1certgen.xslt

@@ -225,22 +225,30 @@
      </xsl:choose>
     </subjectPermissions>
     <xsl:choose>
-     <xsl:when test="@minChainLength and not(@minChainLength='1')">
-       <minChainLength><xsl:value-of select="@minChainLength"/></minChainLength>
+     <xsl:when test="@minChainLength">
+       <xsl:if test="not(@minChainLength='1')">
+         <minChainLength><xsl:value-of select="@minChainLength"/></minChainLength>
+       </xsl:if>
      </xsl:when>
-     <xsl:when test="@minLength and not(@minLength='1')">
-       <minChainLength><xsl:value-of select="@minLength"/></minChainLength>
+     <xsl:when test="@minLength">
+       <xsl:if test="not(@minLength='1')">
+         <minChainLength><xsl:value-of select="@minLength"/></minChainLength>
+       </xsl:if>
      </xsl:when>
      <xsl:when test="$certType = 'ROOT'">2
        <minChainLength>2</minChainLength>
      </xsl:when>
     </xsl:choose>
     <xsl:choose>
-     <xsl:when test="@chainLengthRange and not(@chainLengthRange='0')">
+     <xsl:when test="@chainLengthRange">
+      <xsl:if test="not(@chainLengthRange='0')">
        <chainLengthRange><xsl:value-of select="@chainLengthRange"/></chainLengthRange>
+      </xsl:if>
      </xsl:when>
-     <xsl:when test="@lengthRange and not(@lengthRange='0')">
+     <xsl:when test="@lengthRange">
+      <xsl:if test="not(@lengthRange='0')">
        <chainLengthRange><xsl:value-of select="@lengthRange"/></chainLengthRange>
+      </xsl:if>
      </xsl:when>
     </xsl:choose>
     <xsl:choose>