InvalidBasicConstraints: A certificate's basic constraint extension has not been observed
.net, c#, certificate, wcf, x509certificate
Solution
http://forums.juniper.net/t5/SSL-VPN/quot-Failed-to-authenticate-client-certificate-quot-after/td-p/89232/page/4
After reading the above thread I see there are two different subject types,
Basic Constraints: Subject Type=CA, Length Constraint=None
Basic Constraints: Subject Type=End Entity, Path Length Constraint=None
The server-side certificate I'm using is actually the 3rd link in a hiearchy.
A -> B -> C....A issued B which then issued signed C.
Certificate B also has `Subject Type=End Entity` in the basic constraints. I cannot find any documentation which states the different types of basic contraints or their meanings, but based on the difference of the above 2 types, I would say that `End Entity` means it CANNOT issue certificates. It is the end of the chain, as opposed to `Subject Type=CA`.
When .NET is validating the chain it sees that B does not have permission from it's father certificate to issue certificates and throws the error, `A certificate's basic constraint extension has not been observed`.
Edit: Further testing with a new certificate that was issued by a self-signed certificate verifies the above theory.
Problem
I am getting the error `"InvalidBasicConstraints: A certificate's basic constraint extension has not been observed."` This certificate was issued with OpenSSL and will be used as a server-side test certificate for a WCF service (which gives the same error when validating the certificate). I can replicate the error with this code. ``` X509Certificate2 cert = new X509Certificate2(@"c:\test.cer"); X509Chain chain = X509Chain.Create(); X509ChainPolicy policy = new X509ChainPolicy(); policy.RevocationMode = X509RevocationMode.NoCheck; chain.ChainPolicy = policy; bool valid = chain.Build(cert); Console.WriteLine(string.Join(" -- ", chain.ChainStatus.Select(o => o.Status + ": " + o.StatusInformation))); Console.WriteLine(valid ? "VALID" : "NOT VALID"); ``` Viewing the certificate I can see these basic constraints, ``` Subject Type=End Entity Path Length Constraint=None ``` What does this error mean and how can I fix it? The most relevent article I found on basic constraints was this one, http://unitstep.net/blog/2009/03/16/using-the-basic-constraints-extension-in-x509-v3-certificates-for-intermediate-cas/ however it only talks about prohibiting a child certificate from signing / creating more child certificates which in my case I'm not trying to do. Also any references that explain what the above basic constraints mean would be helpful.