Extensions constrain authority
03Extensions limit how a certificate or subordinate CA can be used.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.2 ↗
RFC 5280 · § 4.2EXAMPLE
3 / 3
03
Critical unknown
A critical extension the processor cannot handle stops validation.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
An unrecognized critical extension requires rejection.
- An unrecognized critical extension requires rejection.
- basicConstraints identifies CA certificates and can bound path length.
- keyUsage and extendedKeyUsage constrain permitted uses when present.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy