How to get BasicConstraints extension from Java X509 certificate

Question

I would like to read the extension BasicConstraints from Java X509Certificate (the certificate implementation comes from default JCE so it is sun.security.x509.X509CertImpl).

I wanted to get the BasicConstraint extension value to check if it is CA :

X509Certificate certificate = ...
byte[] basicConstraint = certificate.getExtensionValue("2.5.29.19");

But this gives me byte array that contains DEROctetString. And after unwrapping it I get byte array with 2 bytes. However the extension BasicConstraint seems to be defined as :

BasicConstraints := SEQUENCE {
    cA                  BOOLEAN DEFAULT FALSE,
    pathLenConstraint   INTEGER (0..MAX) OPTIONAL
}

I have already looked at X509Certificate::getBasicConstraints() method which returns an int. The problem is that it also returns -1 when the extension is not present.

That is why I am looking for a way to get this ASN1 sequence from X509 certificate to explicitly check this CA boolean flag.

Answer 1

The valid encodings of the BasicConstraints extension (within the OCTET STRING) are:

1. CA=false: 30 00

2. CA=true, pathlen omitted: 30 03 01 01 FF

3. CA=true, pathlen=0 to 127: 30 06 01 01 FF 02 01 xx

4. CA=true, pathlen >= 128: using such long paths is so silly I omit this case, but you can work it out using the DER rules if you really want

You most likely have case 1.