1 use const_oid::{db::rfc5280::ID_CE_BASIC_CONSTRAINTS, AssociatedOid, ObjectIdentifier}; 2 use der::Sequence; 3 4 /// BasicConstraints as defined in [RFC 5280 Section 4.2.1.9]. 5 /// 6 /// ```text 7 /// BasicConstraints ::= SEQUENCE { 8 /// cA BOOLEAN DEFAULT FALSE, 9 /// pathLenConstraint INTEGER (0..MAX) OPTIONAL 10 /// } 11 /// ``` 12 /// 13 /// [RFC 5280 Section 4.2.1.9]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9 14 #[derive(Clone, Debug, Eq, PartialEq, Sequence)] 15 #[allow(missing_docs)] 16 pub struct BasicConstraints { 17 #[asn1(default = "Default::default")] 18 pub ca: bool, 19 pub path_len_constraint: Option<u8>, 20 } 21 22 impl AssociatedOid for BasicConstraints { 23 const OID: ObjectIdentifier = ID_CE_BASIC_CONSTRAINTS; 24 } 25 26 impl crate::ext::AsExtension for BasicConstraints { critical( &self, _subject: &crate::name::Name, _extensions: &[crate::ext::Extension], ) -> bool27 fn critical( 28 &self, 29 _subject: &crate::name::Name, 30 _extensions: &[crate::ext::Extension], 31 ) -> bool { 32 // https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9 33 // Conforming CAs MUST include this extension in all CA certificates 34 // that contain public keys used to validate digital signatures on 35 // certificates and MUST mark the extension as critical in such 36 // certificates. This extension MAY appear as a critical or non- 37 // critical extension in CA certificates that contain public keys used 38 // exclusively for purposes other than validating digital signatures on 39 // certificates. Such CA certificates include ones that contain public 40 // keys used exclusively for validating digital signatures on CRLs and 41 // ones that contain key management public keys used with certificate 42 // enrollment protocols. This extension MAY appear as a critical or 43 // non-critical extension in end entity certificates. 44 45 // NOTE(baloo): from the spec, it doesn't appear to hurt if we force the extension 46 // to be critical. 47 true 48 } 49 } 50