{"record":{"id":"7cfdda8be9baccc2","repo":"gravitational/teleport","slug":"basic-constraints-not-valid-basicconstraintsvalid","errorCode":null,"errorMessage":"basic constraints not valid (BasicConstraintsValid=false)","messagePattern":"basic constraints not valid \\(BasicConstraintsValid=false\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/subca/parsed.go","lineNumber":349,"sourceCode":"\t// Trace not used on purpose. Errors are trace-wrapped up in the chain.\n\tcertClusterName, err := tlsca.ClusterName(cert.Subject)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cluster name: %w\", err)\n\t}\n\tif certClusterName != clusterName {\n\t\treturn fmt.Errorf(\n\t\t\t\"incorrect cluster name %q (expected %q)\",\n\t\t\tcertClusterName,\n\t\t\tclusterName,\n\t\t)\n\t}\n\n\t// Verify certificate constraints.\n\tswitch {\n\tcase !cert.IsCA:\n\t\treturn errors.New(\"not a CA certificate (IsCA=false)\")\n\tcase !cert.BasicConstraintsValid:\n\t\treturn errors.New(\"basic constraints not valid (BasicConstraintsValid=false)\")\n\tcase cert.KeyUsage&x509.KeyUsageCertSign == 0:\n\t\t// Usage names per Go 1.26.1.\n\t\t// https://cs.opensource.google/go/go/+/refs/tags/go1.26.1:src/crypto/x509/x509_string.go;l=23\n\t\treturn errors.New(\"missing KeyUsage keyCertSign\")\n\tcase cert.KeyUsage&x509.KeyUsageCRLSign == 0:\n\t\treturn errors.New(\"missing KeyUsage cRLSign\")\n\tcase cert.NotBefore.After(cert.NotAfter):\n\t\treturn errors.New(\"NotBefore > NotAfter\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":331,"sourceCodeEnd":362,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/subca/parsed.go#L331-L362","documentation":"validateOverrideCertificate requires BasicConstraintsValid to be true on the override certificate. Even when IsCA is true, a missing or malformed basic constraints extension means Go cannot verify the CA constraint, so the certificate is rejected as unsafe for use as an issuing CA.","triggerScenarios":"Supplying an override certificate whose X.509 Basic Constraints extension is absent (cert.BasicConstraintsValid=false), typically when IsCA may be true but the extension was never emitted during issuance.","commonSituations":"Certificates generated by custom/legacy tooling that omits the basicConstraints extension; hand-crafted certs via Go's x509.CreateCertificate without setting BasicConstraintsValid; old internal PKI material.","solutions":["Re-issue the certificate with the Basic Constraints extension present and critical, e.g. CA:TRUE.","Check with 'openssl x509 -in cert.pem -text' that the 'X509v3 Basic Constraints' section exists and shows CA:TRUE.","If you control generation code, set template.BasicConstraintsValid = true and template.IsCA = true before x509.CreateCertificate."],"exampleFix":"// before\ntemplate := &x509.Certificate{ IsCA: true } // BasicConstraintsValid missing\n// after\ntemplate := &x509.Certificate{\n  IsCA:                  true,\n  BasicConstraintsValid: true,\n  KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,\n}","handlingStrategy":"validation","validationCode":"if !cert.BasicConstraintsValid {\n    return errors.New(\"override cert missing valid Basic Constraints (CA:TRUE)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify the Basic Constraints extension exists with openssl before deployment.","When minting CAs in Go, always set BasicConstraintsValid=true alongside IsCA=true.","Prefer established CA tooling (easyrsa, cfssl, step-ca) that emits correct extensions."],"tags":["x509","certificate","ca","validation"],"backgroundTag":"certificate-not-a-ca","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}