add role-aware resource certificate profile

src/data_model/ta.rs

@@ -5,6 +5,7 @@ use crate::data_model::oid::OID_CP_IPADDR_ASNUMBER;
 use crate::data_model::rc::{
     AsIdentifierChoice, IpAddressChoice, ResourceCertKind, ResourceCertificate,
     ResourceCertificateParseError, ResourceCertificateParsed, ResourceCertificateProfileError,
+    ResourceCertificateRole,
 };
 use crate::data_model::tal::Tal;
 
@@ -218,6 +219,7 @@ impl TaCertificateParsed {
         if rc_ca.kind != ResourceCertKind::Ca {
             return Err(TaCertificateProfileError::NotCa);
         }
+        rc_ca.validate_rfc6487_profile(ResourceCertificateRole::TrustAnchor)?;
 
         if rc_ca.tbs.issuer_name != rc_ca.tbs.subject_name {
             return Err(TaCertificateProfileError::NotSelfSignedIssuerSubject);