Mints a downstream CA under the realm's authority, for NewDownstreamX509CA.
the realm, lifetime and key type
the CA's certificate, private key and chain
an Error when the realm has no X.509 authority
Mints a downstream CA under the realm's authority, for NewDownstreamX509CA.