KU_KEY_CERT_SIGN
} else if (ku_reject(issuer, KU_KEY_CERT_SIGN)) {
if (ku_reject(x, KU_KEY_CERT_SIGN))
if ((x->ex_kusage & (KU_KEY_CERT_SIGN | KU_CRL_SIGN)) != 0)
CB_FAIL_IF((x->ex_kusage & KU_KEY_CERT_SIGN) == 0, ctx,
CB_FAIL_IF((x->ex_kusage & KU_KEY_CERT_SIGN) != 0, ctx, x, i,