Basic Constraints Extension Constraint - Red Hat CERTIFICATE SYSTEM 8.0 - ADMINISTRATION Admin Manual

Appendix B. Defaults, Constraints, and Extensions for Certificates and CRLs
B.2.1. Basic Constraints Extension Constraint
The Basic Constraints extension constraint checks if the basic constraint in the certificate request
satisfies the criteria set in this constraint.
Parameter
Critical
IsCA
PathLen
452
Description
Specifies whether the extension can be marked
critical or noncritical. Select true to allow this
extension to be mark critical; select false to
prevent this extension from being marked critical.
Specifies whether the certificate subject is a CA.
Select true to allow a value of true for this
parameter; select false to disallow a value
of true for this parameter; select a hyphen,
-, to indicate no constraints are placed for this
parameter.
Specifies the maximum allowable path length,
the maximum number of CA certificates that
may be chained below (subordinate to) the
subordinate CA certificate being issued. The path
length affects the number of CA certificates used
during certificate validation. The chain starts with
the end-entity certificate being validated and
moves up.
This parameter has no effect if the extension is
set in end-entity certificates.
The permissible values are 0 or n. The value
must be less than the path length specified in the
Basic Constraints extension of the CA signing
certificate.
0 specifies that no subordinate CA certificates
are allowed below the subordinate CA certificate
being issued; only an end-entity certificate may
follow in the path.
n must be an integer greater than zero. This
is the maximum number of subordinate CA
certificates allowed below the subordinate CA
certificate being used.
If the field is blank, the path length defaults to
a value determined by the path length set on
the Basic Constraints extension in the issuer's
certificate. If the issuer's path length is unlimited,
the path length in the subordinate CA certificate
is also unlimited. If the issuer's path length is an
integer greater than zero, the path length in the
subordinate CA certificate is set to a value one
less than the issuer's path length; for example,