Set CA basic constraints to "critical". Fixes #1073

diff --git a/raddb/certs/ca.cnf b/raddb/certs/ca.cnf
index 8e866e0..d49991b 100644 (file)
--- a/raddb/certs/ca.cnf
+++ b/raddb/certs/ca.cnf
@@ -57,6 +57,6 @@ commonName            = "Example Certificate Authority"
 [v3_ca]
 subjectKeyIdentifier   = hash
 authorityKeyIdentifier = keyid:always,issuer:always
-basicConstraints       = CA:true
+basicConstraints       = critical,CA:true
 crlDistributionPoints  = URI:http://www.example.org/example_ca.crl