When trying to encode a BasicConstraintsExtension with ca=false and a default pathlen (-1), the following exception is thrown:
Caused by: java.io.IOException: No value to encode for the extension!
at sun.security.x509.Extension.encode(Extension.java:173)
at sun.security.x509.BasicConstraintsExtension.encode(BasicConstraintsExtension.java:204)
The reason is the codes below in BasicConstraintsExtension.java,
private void encodeThis() throws IOException {
if (ca == false && pathLen < 0) {
this.extensionValue = null;
return;
}
....
The ASN.1 definition for the extension (RFC 5280 4.2.1.9) declares both field as optional inside a SEQUENCE.