thlen:1</code></pre>

<p>A CA certificate <i>must</i> include the <b>basicConstraints</b> name with the <b>CA</b> parameter set to <b>TRUE</b>. An end-user certificate must either have <b>CA:FALSE</b> or omit the extension entirely. The <b>pathlen</b> parameter specifies the maximum number of CAs that can appear below this one in a chain. A <b>pathlen</b> of zero means the CA cannot sign any sub-CA&#39;s, and can only sign end-entity certificates.</p>

<h2 id="Key-Usage">Key Usage</h2>

<p>Key usage is a mu