Basic Constraints (basicConstraints extension)

Basic Constraints has two fields: cA, a boolean, and an optional pathLenConstraint. When cA is true, the certificate's key may sign other certificates, together with the keyCertSign key usage; the path length limits how many further intermediate CAs may follow it in a chain. RFC 5280 requires the extension, marked critical, in all CA certificates, while end-entity certificates either omit it or set CA:FALSE.

Why it matters

This flag is what stops a website's certificate from acting as a CA. Early TLS implementations that failed to check it let anyone holding an ordinary certificate mint certificates for other domains, a lesson that made the check universal in X.509 path validation. It also explains real errors: a server certificate generated with CA:TRUE can be rejected by Firefox with MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY, and a subordinate CA with pathlen:0 cannot issue another intermediate.

Example

X509v3 Basic Constraints: critical
    CA:TRUE, pathlen:0

This is how openssl x509 -noout -text shows a CA that may issue only end-entity certificates. A leaf certificate shows CA:FALSE.

Common misconceptions

• pathlen:0 means the CA cannot issue anything. It can issue end-entity certificates; it just cannot issue further CA certificates.
• Every self-signed certificate should be a CA. A self-signed root needs CA:TRUE, but a self-signed certificate used directly as a server certificate should not have it.