BasicConstraints
RFC 5280 §4.2.1.9 Basic Constraints.
A certificate with ca: true may issue other certificates; pathLength limits how many additional CAs may appear below it in the chain.
ts
type BasicConstraints = {
readonly ca: false;
readonly pathLength?: undefined
} | {
readonly ca: true;
readonly pathLength?: number
}