Study. uk . com
  1. Home
  2. All questions
  3. Question 247

CISSP study material · question 247 of 500

A certificate authority certificate carries a path length constraint of zero. What does that permit in a valid certification path?

  1. Exactly one intermediate certificate may follow it.
  2. No non-self-issued intermediate certificates may follow it, though an end entity certificate still may.
  3. Any number of intermediates may follow, since zero disables the limit.
  4. No further certificates of any kind may follow it.
Show the answer

Answer: B. No non-self-issued intermediate certificates may follow it, though an end entity certificate still may.

The field caps how many intermediates that are not self-issued may follow, so zero permits none; the final end entity certificate falls outside the count.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.9 Basic Constraints

Challenge yourself on this topic → Study as cards