BTW if ever you were not fully satisfied by the solution given by Peter, you can create certificate that are conformant to RFC2459 (no basicConstraint) and will be protected against this problem by making sure the Basic Constraint of the CA that emits them as a path length restriction of 0 (final CA, can only emit EE certs).To complicate matters Microsoft Security Bulletin MS02-050 describes an exploitation whereby unpatched CSPs do not process basicConstraints at all leaving them vulnerable to ID spoofing attacks ( CAN-2002-0862 ) . This problem is fixed by a patch which enforces a check on basicConstraints.