303-300 · Question #93
An X509 certificate contains the following information: X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Which of the following statements are true regarding the certificate? (Choose THREE…
The correct answer is A. This certificate belongs to a certification authority. B. This certificate may be used to sign certificates of subordinate certification authorities. D. This certificate may be used to sign certificates that are not also a certification authority. Important note: The provided answer key (A, B, D) appears to contain an error. Based on RFC 5280, the correct answers should be A, D, and E. --- CA:TRUE makes A correct - this certificate belongs to a CA and can sign other certificates. pathlen:0 makes D correct - it permits…
Question
An X509 certificate contains the following information:
X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Which of the following statements are true regarding the certificate? (Choose THREE correct answers.)
Options
- AThis certificate belongs to a certification authority.
- BThis certificate may be used to sign certificates of subordinate certification authorities.
- CThis certificate may never be used to sign any other certificates.
- DThis certificate may be used to sign certificates that are not also a certification authority.
- EThis certificate will not be accepted by programs that do not understand the listed extension.
How the community answered
(47 responses)- A85% (40)
- C11% (5)
- E4% (2)
Explanation
Important note: The provided answer key (A, B, D) appears to contain an error. Based on RFC 5280, the correct answers should be A, D, and E.
CA:TRUE makes A correct - this certificate belongs to a CA and can sign other certificates. pathlen:0 makes D correct - it permits signing end-entity (non-CA) certificates only. The critical keyword makes E correct - RFC 5280 requires that any program encountering a critical extension it cannot process must reject the certificate entirely.
Why B is wrong: pathlen:0 explicitly means zero intermediate CA certificates may follow this certificate in a valid chain. RFC 5280 states: "A pathLenConstraint of zero indicates that only an end entity certificate may follow in the path." This CA cannot sign subordinate CAs.
Why C is wrong: It can sign certificates - specifically end-entity (non-CA) certificates. pathlen:0 restricts what kind of cert it can sign, not whether it can sign at all.
Memory tip: Think of pathlen as "how many CA hops are allowed below me." pathlen:0 = zero more CAs in the chain, so only leaf/end-entity certs can follow. The word critical always means "reject if you don't understand this" - it's a hard stop, not advisory.
If this question came from a specific exam bank, it's worth flagging - B and E appear to be swapped in the answer key.
Topics
Community Discussion
No community discussion yet for this question.