testing: Add scenarios that use a CA with two intermediate CA certificates

Mainly to test TKM's ability for handling multiple CAs and that the
received intermediate CA certificates are passed in the right order.
But also added a regular scenario where two intermediate CA certificates
are sent by one of the clients.

testing/hosts/winnetou/etc/ca/generate-crl

@@ -82,6 +82,18 @@ do
   mv ${CERTS_DIR}/cert.der ${CERTS_DIR}/`sha1sum ${CERTS_DIR}/cert.der | head -c 40`
 done
 
+##
+# Levels CA and sub-CAs
+cd /etc/ca/levels
+
+# generate CRLs for Levels CA and sub-CAs
+pki --signcrl --cakey levelsKey.pem --cacert levelsCert.pem \
+    > ${ROOT}/levels.crl
+pki --signcrl --cakey levelsKey_l2.pem --cacert levelsCert_l2.pem \
+    > ${ROOT}/levels_l2.crl
+pki --signcrl --cakey levelsKey_l3.pem --cacert levelsCert_l3.pem \
+    > ${ROOT}/levels_l3.crl
+
 ##
 # strongSwan EC Root CA
 cd /etc/ca/ecdsa