Certificates Basic Constraint's Path Length

path certificate constraints
Matt picture Matt · Jul 7, 2011 · Viewed 29.1k times · Source

Is having a Path Length of 0 and None the same thing for Basic Constraint's of a CA type? To clarify, does a path length of 0 mean that the CA can issue no certificates while a path length of none mean that it can issue an infinite amount of certificates?

Answer

emboss picture emboss · Jul 8, 2011

Taken from RFC 5280, section 4.2.1.9:

A pathLenConstraint of zero indicates that no non-self-issued intermediate CA certificates may follow in a valid certification path. Where it appears, the pathLenConstraint field MUST be greater than or equal to zero. Where pathLenConstraint does not appear, no limit is imposed.

I.e. a pathLenConstraintof 0 does still allow the CA to issue certificates, but these certificates must be end-entity-certificates (the CA flag in BasicConstraints is false - these are the "normal" certificates that are issued to people or organizations).

It also implies that with this certificate, the CA must not issue intermediate CA certificates (where the CA flag is true again - these are certificates that could potentially issue further certificates, thereby increasing the pathLen by 1).

An absent pathLenConstraint on the other hand means that there is no limitation considering the length of certificate paths built from an end-entity certificate that would lead up to our example CA certificate. This implies that the CA could issue a intermediate certificate for a sub CA, this sub CA could again issue an intermediate certificate, this sub CA could again... until finally one sub CA would issue an end-entity certificate.

If the pathLenConstraintof a given CA certificate is > 0, then it expresses the number of possible intermediate CA certificates in a path built from an end-entity certificate up to the CA certificate. Let's say CA X has a pathLenConstraint of 2, the end-entity certificate is issued to EE. Then the following scenarios are valid (I denoting an intermediate CA certificate)

X - EE
X - I1 - EE
X - I1 - I2 - EE

but this and those scenarios with even more intermediate CAs are not

X - I1 - I2 - I3 - EE
...

Related questions

How can I safely create a nested directory?

What is the most elegant way to check if the directory a file is going to be written to exists, and if not, create the directory using Python? Here is what I tried: import os file_path = "/my/directory/filename.…

Read More
How to permanently set $PATH on Linux/Unix?

I'm trying to add a directory to my path so it will always be in my Linux path. I've tried: export PATH=$PATH:/path/to/dir This works, however each time I exit the terminal and start a new terminal …

Read More
Adding a directory to the PATH environment variable in Windows

I am trying to add C:\xampp\php to my system PATH environment variable in Windows. I have already added it using the Environment Variables dialog box. But when I type into my console: C:\>path it doesn't show …

Read More