/* CA checks common to all purposes return codes: 0 not a CA 1 is a CA 2 basicConstraints absent so "maybe" a CA 3 basicConstraints absent but self signed V1. 4 basicConstraints absent but keyUsage present and keyCertSign asserted.  */
static int check_ca(const X509 *x)
/* CA checks common to all purposes return codes: 0 not a CA 1 is a CA 2 basicConstraints absent so "maybe" a CA 3 basicConstraints absent but self signed V1. 4 basicConstraints absent but keyUsage present and keyCertSign asserted.  */
static int check_ca(const X509 *x)
{
    if (ku_reject(x, KU_KEY_CERT_SIGN))
        return 0;
    if (x->ex_flags & EXFLAG_BCONS) {
        if (x->ex_flags & EXFLAG_CA)
            return 1;
        else
            return 0;
    } else {
        if ((x->ex_flags & V1_ROOT) == V1_ROOT)
            return 3;
        else if (x->ex_flags & EXFLAG_KUSAGE)
            return 4;
        else if (x->ex_flags & EXFLAG_NSCERT && x->ex_nscert & NS_ANY_CA)
            return 5;
        return 0;
    }
}