We have an SSL cert from GoDaddy and tried to run a PCI compliance check using McAfee's scan. The one problem they found was that the basic constraints / path length is not configured. Here's what they wrote back:
An X.509 certificate sent by the remote host contains one or more violations of the restrictions imposed on it by RFC 3280. This means that either a root or intermediate Certificate Authority signed a certificate incorrectly. Certificates that fail to adhere to the restrictions in their extensions may be rejected by certain software. The existence of such certificates indicates either an oversight in the signing process, or malicious intent.
Please follow the below steps to test the vulnerability manually: -Use Internet Explorer. -Enter the URL using 'https://'. -Click on the Browser tab: View -Click Security Report -Click on the Pop-Up 'View Certificates'. -Click on the Details tab. -Cursor 'Field' to 'Basic Constraints' -You may view the 'Path Length Constraint='
If the 'Certificate Basic Constraints' is set to False, Internet Explorer will not properly check the Certificate Authority.
'Certificate Basic Constraints' indicates 'Path Length Constraint='. This indicates how deep the Certificate Authority will be checked. If the 'Path....' Is set for '1', then the Certificate Authority above will be checked. However, if the browser checks and finds five Certificate Authority's, but 'Path....' Is set for '1', then there is a mismatch. Internet Explorer will accept the error and not warn, but other browsers will check and warn of the mismatch.
It looks like they acknowledged the issue: http://community.godaddy.com/groups/community/forum/topic/ssl-certificate-fails-to-adhere-to-basic-constraints-key-usage-extensions/
I've looked at a few other SSL sellers like GeoTrust, Comodo, Thawte, and they all seem to have the same issue -- at least going through the steps above McAfee suggests to check. None of the online SSL checkers I tried report any issues.
Is this a fairly recent change / requirement that all these companies didn't get a chance to adjust to? Any idea how long it would take for something like this to get fixed? Are there any workarounds to this issue? Any way I could modify the SSL (Windows Server 2008 R2) to include this "Path Length" restriction?