permissible OIDs as of the previous certificate, including any policy mapping equivalencies asserted by the previous certificate; Policy constraints and basic constraints are checked, to ensure that any explicit policy requirements are not violated and that the certificate is a CA certificate, respectively. This step is crucial in preventing some man in the middle attacks; The path length is checked to ensure that it does not exceed any maximum path length asserted in this or a previous certificate; The key usage extension is checked to ensure that is allowed to sign certificates; and Any other critical extensions are recognized and processed. If this procedure reaches the last certificate in the chain, with no name constraint or policy violations or any other error condition, then the certificate path validation algorithm terminates successfully. External links See also Delegated Path Discovery Delegated Path Validation Cryptographic protocols