Function is_ca_certificate

crates/stdlib/src/ssl/cert.rs:271–287

Check if a certificate is a CA certificate by examining the Basic Constraints extension Returns `true` if the certificate has Basic Constraints with CA=true, `false` otherwise (including parse errors or missing extension). This matches OpenSSL's X509_check_ca() behavior.

(cert_der: &[u8])

/// `false` otherwise (including parse errors or missing extension).
/// This matches OpenSSL's X509_check_ca() behavior.
pub fn is_ca_certificate(cert_der: &[u8]) -> bool {
    // Parse the certificate
    let Ok((_, cert)) = X509Certificate::from_der(cert_der) else {
        return false;
    };

    // Check Basic Constraints extension
    // If extension exists and CA=true, it's a CA certificate
    // Otherwise (no extension or CA=false), it's NOT a CA certificate
    if let Ok(Some(ext)) = cert.basic_constraints() {
        return ext.value.ca;
    }

    // No Basic Constraints extension -> NOT a CA certificate
    // (matches OpenSSL X509_check_ca() behavior)
    false
}

/// Convert an X509Name to Python nested tuple format for SSL certificate dicts
///