Study. uk . com
  1. Home
  2. All questions
  3. Question 249

CISSP study material · question 249 of 500

An authority issues a certificate authority certificate whose key validates signatures on other certificates, and marks the basic constraints extension non-critical. What does RFC 5280 require?

  1. The extension is optional where the path length constraint is absent.
  2. The extension must be present and marked critical in such certificates.
  3. The extension may be non-critical provided keyUsage is critical.
  4. The extension must be omitted and replaced by name constraints.
Show the answer

Answer: B. The extension must be present and marked critical in such certificates.

Conforming certificate authorities must include basic constraints in all CA certificates containing public keys used to validate signatures on certificates, and must mark the extension critical.

Source: RFC 5280 (IETF) — RFC 5280 > 4.2.1.9 Basic Constraints

Challenge yourself on this topic → Study as cards