Study. uk . com
  1. Home
  2. All questions
  3. Question 243

CISSP study material · question 243 of 500

An intermediate certificate asserts keyCertSign but its basic constraints extension leaves the CA boolean unset. What must a conforming relying party do with the certificate's public key?

  1. Refuse to use it to verify signatures on certificates.
  2. Accept it only for verifying revocation list signatures.
  3. Treat the certificate as an end entity certificate and accept it for signatures generally.
  4. Accept it, since keyCertSign alone grants the capability.
Show the answer

Answer: A. Refuse to use it to verify signatures on certificates.

Setting keyCertSign obliges the issuer to assert the CA boolean too; without that boolean the key may not check signatures over other certificates.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.3 Key Usage and 4.2.1.9 Basic Constraints

Challenge yourself on this topic → Study as cards