Check that metadata ROOTs BasicConstaints are set to FALSE

[yackermann]

By submitting this issue you are acknowledging that any information regarding this issue will be publicly available.

If you have privacy concerns, please email conformance-tools@fidoalliance.org

FIRST PRE CHECK

• [x] I SOLEMNLY SWEAR THAT I HAVE SEARCHED DOCUMENTATION AND WAS NOT ABLE TO RESOLVE MY ISSUE

What protocol are you implementing?

• [x] CTAP2.0
• [x] CTAP2.1
• [x] UAF 1.1
• [x] U2F 1.1
• [x] U2F 1.2

NOTE: UAF 1.0 certification have been officially sunset. U2F 1.2 only supported version of U2F.

What is your implementation class?

• [x] Security Key / FIDO2 / U2F authenticators
• [ ] Server
• [x] UAF Client-ASM-Authenticator combo
• [ ] UAF Client
• [x] UAF ASM-Authenticator

If you are platform authenticator vendor, please email conformance-tools@fidoalliance.org

Issue description

During the interop testing we found that if metadata root certificate BasicConstraint extension is marked as critical it is failing on majority of the servers.

I suggest adding test that checks that Root certificate BasicConstaint extension is set to FALSE.