---
name: "libressl-BASIC_CONSTRAINTS_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-BASIC_CONSTRAINTS_new"
---

# libressl-BASIC\_CONSTRAINTS\_new(3)

X.509 extension to mark CA certificates

## NAME

**BASIC\_CONSTRAINTS\_new**, **BASIC\_CONSTRAINTS\_free** – X.509 extension to mark CA certificates

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*BASIC\_CONSTRAINTS* *\**\

**BASIC\_CONSTRAINTS\_new**(*void*);

*void*\

**BASIC\_CONSTRAINTS\_free**(*BASIC\_CONSTRAINTS \*bc*);

## DESCRIPTION

**BASIC\_CONSTRAINTS\_new**() allocates and initializes an empty *BASIC\_CONSTRAINTS* object, representing an ASN.1 *BasicConstraints* structure defined in RFC 5280 section 4.2.1.9.

This object contains two fields. The field *int ca* is non-zero if the certificate is a CA certificate. The field *ASN1\_INTEGER \*pathlen* specifies the maximum number of non-self-issued intermediate certificates that may follow this certificate in a valid certification path.

If an X.509 version 3 certificate does not contain this extension or if the *ca* field of the *BASIC\_CONSTRAINTS* object is 0, or if the certificate contains a key usage extension having the KU\_KEY\_CERT\_SIGN bit unset, then it is not a CA certificate but an end entity certificate.

**BASIC\_CONSTRAINTS\_free**() frees *bc*.

## RETURN VALUES

**BASIC\_CONSTRAINTS\_new**() returns the new *BASIC\_CONSTRAINTS* object or NULL if an error occurs.

## SEE ALSO

d2i\_BASIC\_CONSTRAINTS(3), X509\_check\_purpose(3), X509\_EXTENSION\_new(3), X509\_get\_extension\_flags(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

- section 4.2.1.9: Basic Constraints

- section 6.1: Basic Path Validation

## HISTORY

**BASIC\_CONSTRAINTS\_new**() and **BASIC\_CONSTRAINTS\_free**() first appeared in OpenSSL 0.9.2b and have been available since OpenBSD 2.6.