#include <p6gencerts.h>
A certificate can have zero or more extensions which take the form of a name=value pair.
The "basicContraints" extension allows the certification creator to define whether the cert is allowed to be used as a CA's cert for signing. Another used extension is "subjectAltName" which can be a FQDN.
name = basicConstraints
value = CA:TRUE