3.1.2.4.2.2.1.4 Certificate.Template.pKIMaxIssuingDepth

  • Article

If a Basic Constraints extension (as specified in [RFC3280] section 4.2.1.10) is being added to the request:

  • If the value of the cA field of the Basic Constraints extension is TRUE:

    • If the value of the Certificate.Template.pKIMaxIssuingDepth datum is not equal 0xFFFFFFFF, the client MUST use the value of the Certificate.Template.pKIMaxIssuingDepth datum to populate the pathLenConstraint field of the Basic Constraints extension.

    • If the value of the Certificate.Template.pKIMaxIssuingDepth datum is equal to 0xFFFFFFFF, the client MUST NOT include the pathLenConstraint field in the Basic Constraints extension.

  • If the value of the cA field of the Basic Constraints extension is FALSE, the client MUST NOT include the pathLenConstraint field in the Basic Constraints extension.

The conditions under which the Basic Constraints extension is added to the request are specified in sections 3.1.2.4.2.2.1.1 and 3.1.2.4.2.2.2.7.