Constraints Reference; Basics Constraints Extension Constraint - Red Hat CERTIFICATE SYSTEM 7.1 - ADMINISTRATOR Administrator's Manual

Constraints Reference

Constraints are used to define the allowable contents of a certificate and the values
associated with that content. This section lists the pre built constraints with complete
definitions of each.

Basics Constraints Extension Constraint

The basic constraints extension constraint checks if the basic constraint in the certificate
request satisfies the criteria set in this constraint.
Table 11-18 Basic Constraints Extension Constraint Configuration Parameters
Parameter
Critical
IsCA
PathLen
Description
Specifies whether the extension can be marked critical or noncritical.
Select true to allow this extension to be mark critical, select false to
prevent this extension from being marked critical; select "-" to
indicate no constraints are placed for this parameter.
Specifies whether the certificate subject is a CA. Select true to allow a
value of true for this parameter, select false to disallow a value of true
for this parameter, select "-" to indicate no constraints are placed for
this parameter.
Specifies the maximum allowable path length, the maximum number
of CA certificates that may be chained below (subordinate to) the
subordinate CA certificate being issued. Note that the path length you
specify affects the number of CA certificates to be used during
certificate validation. The chain starts with the end-entity certificate
being validated and moving up the chain.
This parameter has no effect if the extension is set in end-entity
certificates.
Permissible values: 0 or n. Make sure that the value you choose is less
than the path length specified in the Basic Constraints extension of the
CA signing certificate (owned by the CA that will issue these
certificates).
• 0 specifies that no subordinate CA certificates are allowed below
the subordinate CA certificate being issued—that is, only an
end-entity certificate may follow in the path.
• n must be an integer greater than zero. It specifies at the most n
subordinate CA certificates are allowed below the subordinate CA
certificate being used.
Constraints Reference
Chapter 11 Certificate Profiles 453