Share via

3.2.2.6.2.1.4.4.5 pKIMaxIssuingDepth

  • Article

If a Basic Constraints extension (as specified in [RFC3280] section 4.2.1.10) is being added to the certificate:

  • If the value of the cA field of the Basic Constraints extension is TRUE:

    • If the value of the pKIMaxIssuingDepth attribute is not equal to 0xFFFFFFFF, the CA MUST use the value of the pKIMaxIssuingDepth attribute to populate the pathLenConstraint field of the Basic Constraints extension.

    • If the value of the pKIMaxIssuingDepth attribute is equal to 0xFFFFFFFF, the CA MUST NOT include the pathLenConstraint field in the Basic Constraints extension.

  • If the value of the cA field of the Basic Constraints extension is FALSE, the CA MUST NOT include the pathLenConstraint field in the Basic Constraints extension.

The conditions under which a Basic Constraints extension is added to the certificate are specified in sections 3.2.2.6.2.1.4.4.1 and 3.2.2.6.2.1.4.5.6.