Basic constraints

What it means

Whether this certificate is a CA (may sign other certificates) and, if so, how deep a chain it may sign (path length).

Why it matters

This is the line between 'a certificate' and 'a certificate authority'. A leaf certificate with CA=true is a red flag; a CA certificate installed as a server certificate won't work properly either.