pygost/asn1schemas/cert-selfsigned-example.py | 6 +++++-

diff --git a/pygost/asn1schemas/cert-selfsigned-example.py b/pygost/asn1schemas/cert-selfsigned-example.py
index 53bfca2e356a360d503399dadef2b4632bc53a6811d34f7d6f932a5cd2ba5cba..681ca542f0119d684a6a7d66d7f77720aecc9bc2280be06d5ddac4d4ec6b970b 100755
--- a/pygost/asn1schemas/cert-selfsigned-example.py
+++ b/pygost/asn1schemas/cert-selfsigned-example.py
@@ -237,10 +237,14 @@ ]
 if args.ca:
     exts.append(Extension((
         ("extnID", id_ce_basicConstraints),
-        ("extnValue", OctetString(BasicConstraints((("cA", Boolean(True)),)).encode())),
+        ("critical", Boolean(True)),
+        ("extnValue", OctetString(BasicConstraints((
+            ("cA", Boolean(True)),
+        )).encode())),
     )))
     exts.append(Extension((
         ("extnID", id_ce_keyUsage),
+        ("critical", Boolean(True)),
         ("extnValue", OctetString(KeyUsage(("keyCertSign",)).encode())),
     )))
 if ca_ai is not None: