What problem does "max_path_length" attribute in certificates are going to solve?

Question

I'm trying to understand the purpose of defining pathLenConstraint and max_path_length in RFC5280 (Internet X509 PKI Certificate and CRL Profile):

For pathLenConstraint The above mentioned RFC states:

The pathLenConstraint field is meaningful only if the cA boolean is asserted and the key usage extension, if present, asserts the keyCertSign bit (Section 4.2.1.3).

In this case, it gives the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path. (Note: The last certificate in the certification path is not an intermediate certificate, and is not included in this limit. Usually, the last certificate is an end entity certificate, but it can be a CA certificate.)

A pathLenConstraint of zero indicates that no non-self-issued intermediate CA certificates may follow in a valid certification path. Where it appears, the pathLenConstraint field MUST be greater than or equal to zero. Where pathLenConstraint does not appear, no limit is imposed.

And for max_path_length it states:

max_path_length: this integer is initialized to n, is decremented for each non-self-issued certificate in the path, and may be reduced to the value in the path length constraint field within the basic constraints extension of a CA certificate.

So for the first one, the pathLenConstraint), it could make sense: The Root CA want to prevent[limit] the intermediate CA from[for] issueing (signing) other CA certificates (Q1: Why? Is there any security concern?).

But the sencond attribute, the max_path_length, I can't imagine/find any reason. Can somebody please shed me some light?

Answer 1

pathLenConstraint is a field in X.509 Basic Constraints extension and it seems you have figured out what is the purpose of it -- to limit how many CA levels may appear under current certificate. A value of zero disables CA to issue other CA certificates, only end entity certificates are allowed. A value of one would allow only one level of CAs under current CA certificate.

The security concern is that CAs may be administered separately. Say, root CA is managd by HQ admin team and they issue a subordinate CA certificate which will be managed by regional admins (or delegated). In order to ensure that regional (delegated) admins do not accidentally (or deliberately) issue another CA certificates, root CA admins put path length constraint in subordinate CA certificate and set it to zero.

max_path_length isn't an attribute and is not part of certificate. It is a runtime variable inside certificate chaining engine and this variable exist only for certificate chain construction duration. And this variable is checked then against pathLenConstraint in CA certificate to ensure that constraints aren't violated.