Gwangsoo Rhee <rhee(_at_)sookmyung(_dot_)ac(_dot_)kr> writes:
The material below is from RFC 2632. Seems to me that the statements about
end-entity certificates in the last two paragraphs conflict with each other.
One says that end-entity certificates contain a basicConstraints extension and
another says they shouldn't. Maybe I misunderstood those statements. Could
anyone please enlighten me on the subject?
It's a problem with RFC 2459 which is covered, in the X.509 style guide,
http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt. Most of the certs
I've seen seem to ignore the RFC 2459 text, including a basicConstraints
extension in end entity certs, so the problems described in the guide shouldn't
occur much.
Peter.