From 7a07385ee49b476ca9708763a110e78174ecb0d5 Mon Sep 17 00:00:00 2001
From: Simon Josefsson <simon@josefsson.org>
Date: Wed, 1 Oct 2014 21:26:31 +0200
Subject: [PATCH] mark basic constraints as critical

---
 doc/CertificateAuthorityWithNEO.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/CertificateAuthorityWithNEO.txt b/doc/CertificateAuthorityWithNEO.txt
index b418340..55a2380 100644
--- a/doc/CertificateAuthorityWithNEO.txt
+++ b/doc/CertificateAuthorityWithNEO.txt
@@ -67,7 +67,7 @@ counter as follows:
   CN=Yubico Internal HTTPS CA
   [ v3_ca ]
   subjectKeyIdentifier=hash
-  basicConstraints = CA:true, pathlen:1
+  basicConstraints=critical, CA:true, pathlen:1
   keyUsage=critical, keyCertSign, cRLSign
   nameConstraints=@nc
   [ nc ]
@@ -145,7 +145,7 @@ Generate the Sub-CA certificate request:
 Generate the Sub-CA certificate:
 
   cat>yubico-internal-https-subca-$user-crt.conf<<EOF
-  basicConstraints = CA:true, pathlen:0
+  basicConstraints = critical, CA:true, pathlen:0
   keyUsage=critical, keyCertSign
   EOF
   openssl x509 -sha256 -CA yubico-internal-https-ca-crt.pem -CAkey yubico-internal-https-ca-key.pem -req -in yubico-internal-https-subca-$user-csr.pem -extfile yubico-internal-https-subca-$user-crt.conf -out yubico-internal-https-subca-$user-crt.pem