I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile):
For pathLenConstraint The above mentioned RFC states:
pathLenConstraintfield is meaningful only if the cA boolean is asserted and the key usage extension, if present, asserts the keyCertSign bit (Section 22.214.171.124).
In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path. (Note: The last certificate in the certification path is not an intermediate certificate, and is not included in this limit. Usually, the last certificate is an end entity certificate, but it can be a CA certificate.)
A pathLenConstraint of zero indicates that no non-self-issued intermediate CA certificates may follow in a valid certification path. Where it appears, the pathLenConstraint field MUST be greater than or equal to zero. Where pathLenConstraint does not appear, no limit is imposed.
And for max_path_length it states:
max_path_length: this integer is initialized to n, is decremented for each non-self-issued certificate in the path, and may be reduced to the value in the path length constraint field within the basic constraints extension of a CA certificate.
So for the first one, the
pathLenConstraint), it could make sense: The Root CA want to prevent[limit] the intermediate CA from[for] issueing (signing) other CA certificates (Q1: Why? Is there any security concern?).
But the sencond attribute, the
max_path_length, I can't imagine/find any reason. Can somebody please shed me some light?