problem signing a certificate for timestamping

according to [RFC3161 sec 2.3](https://tools.ietf.org/html/rfc3161#section-2.3) when signing a certificate for a time stamping usage, the extended key usage `Time Stamping` must be `critical`.

> id-kp-timeStamping. This extension MUST be critical.

But actually, this is not the case and trying to use openssl cause an error `invalid signer certificate purpose`.

```
139934436660480:error:0E06D06C:configuration file routines:NCONF_get_string:no value:../crypto/conf/conf_lib.c:275:group=tsa_config1 name=crypto_device
139934436660480:error:2F083075:time stamp routines:TS_RESP_CTX_set_signer_cert:invalid signer certificate purpose:../crypto/ts/ts_rsp_sign.c:152:
```

we are using the latest docker image `cfssl/cfssl`

```
cfssl version
Version: 1.2.0
Revision: dev
Runtime: go1.8.1
```