"Basic Constraints" settings in IDP signing certificate

[Schwendner, Joanne]

Hi.

A service with which we integrate recently refused to trust a new IDP
certificate (they require a custom 2-year cert..) because it contained a
"Basic Constraints" CA:TRUE in the extensions section; in particular it had
the "critical" switch turned on, which is probably what triggered the
rejection.  The cert we previously gave them had CA:TRUE but did *not* have
"critical" set.

X509v3 Basic Constraints: critical
       CA:TRUE

This was my first knowledge of this extension.  I've since learned that the
defaults of these settings can vary depending on your OpenSSL version --
which is probably how I stumbled into this.  The OpenSSL doc indicates that
unless a certificate is a CA signed cert, the "Basic Constraints" is
altogether optional.

I am planning to transition our IDP to a new IDP signing cert.  So...
*My question: * When creating the long life, self signed IDP signing
certificate, is it recommended to completely leave out "Basic Constraints"?
   Or set it to CA:FALSE ?

What would be the best practice for this?
If this is in the wiki somewhere, please point me to it!!

Joanne

---

Joanne Schwendner
Identity Services
Office of Information Technology
Brown University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240612/b43af978/attachment.htm>