It has to be allowed to use CA certificates as application instance certificates:

• A self-signed certificate requires to sign itself
• The X509 specification states that the keyCertSign flag has to be set for certificates that sign others, including themselves
  http://tools.ietf.org/html/rfc3280#page-29:
  "The keyCertSign bit is asserted when the subject public key is used for verifying a signature on public key certificates."
• The X509 specification states that the CA flag has to be set if the keyCertSign flag is set
  http://tools.ietf.org/html/rfc3280#page-29:
  "If the keyCertSign bit is asserted, then the CA bit in the basic constraints extension (section 4.2.1.10) MUST also be asserted."

This leads to the conclusion that all self-signed certificates MUST be CA certificates.

This again leads to the test being invalid at this point, as it assumes that CA certificates are not allowed to be used as application instance certificates. Instead, the test should use a certificate which is missing one of the required usage flags (e.g. dataEncipherment).