Is there a standard/definitive way to distinguish the end-entity cert in a PKCS#7 (P7B) cert chain? I believe the PKCS#7 standard doesn't not specify sequence when ordering the certs in the chain, but most tools do sequence them in (either bkw or fwd) signing order). And I know an end cert would have different owner/issuer CNs (root's would be the same for both), was wondering if there was a foolproof differentiator say, in the case of an end and intermediate cert, where both would have different owner/issuer (right?). Thx!
CA certificates (V3) always include
Basic Constraints certificate extension where
isCA attriute is set to
True. End-entity certificates either, omit this extension or include extension with
isCA attrbitue set to
False. Basic Constraints (RFC 5280 §220.127.116.11) is the most reliable way to differentiate CA and end entity certificates.
Here is an example of Basic Constraints extension for CA certificate in Windows Certificate Viewer:
an example of Basic Constraints extension for end entity certificate in Windows Certificate Viewer: