- BasicConstraints: CA=false (critical) - SubjectKeyIdentifier via SHA-1 hash - AuthorityKeyIdentifier linked to issuer cert