[ proxy ]
# A proxy certificate MUST NEVER be a CA certificate.
basicConstraints = CA:FALSE
# Usual authority key ID
authorityKeyIdentifier = keyid,issuer:always
# The extension which marks this certificate as a proxy
proxyCertInfo = critical,language:id-ppl-anyLanguage,pathlen:1,policy:text:AB</code></pre>

<p>It&#39;s also possible to specify the proxy extension in a separate section:</p>

<pre><code>proxyCertInfo = critical,@proxy_ext

[ proxy_ext ]
language = id-ppl-anyLanguage
pathlen = 0
policy = text