X509 basic constraints