Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose a leaf node creates a certificate for a different domain, acting as a CA.

Do most popular frameworks, or SSL chain validation tools verify the constraints? Are there any I should be concerned with, and remove from my production environment?

Should I be concerned with CA's issuing certificates without basic constraints?

How can I protect my website (as a server operator), and my web browsing session (as a consumer) from certificates generated by leaf nodes, or improperly configured CAs?

share|improve this question
up vote 4 down vote accepted

Up to a few years ago (something like 2003 or 2004, if I remember correctly), Internet Explorer was not verifying the "Basic Constraints" extension. When this was discovered, Microsoft promptly published a patch.

On a general basis, the "Basic Constraints" extension is properly verified by all existing validators. Internet Explorer was really the worst student in the class on that matter. It is called "basic" for a reason: it is the simplest X.509 extension to handle.

You protect yourself against badly configured CA by ceasing to trust the relevant trust anchors, and sending lawyers to punish such misbehaviour.

share|improve this answer
Since this answer was posted I found an even more detailed question and answer here. – LamonteCristo Jul 25 '13 at 22:32

Moxie Marlinspike did a lot of SSL research. He presented some of it years ago, among which an overview of browsers ignoring the basic constraints. It seems to have been fixed now in most SSL implementations.

However, is a very good watch if you want to know more about SSL vulnerabilities :-)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.