openssl x509 -req allows a non-CA certificate (cA=FALSE, keyUsage=keyCertSign) to issue a child certificate

Description:

Steps to Reproduce

I created a self‑signed root certificate with the following contradictory extensions:

• basicConstraints=CA:FALSE
• keyUsage=keyCertSign, cRLSign, digitalSignature

This certificate is not a CA but claims the right to sign certificates. I then used OpenSSL's openssl x509 -req command to attempt to issue a child certificate using this inconsistent root certificate as the issuer.

The following script reproduces the issue on a fresh Ubuntu 22.04 system with OpenSSL 3.0.13.

# 1. Generate the inconsistent root certificate
openssl req -new -x509 -newkey rsa:2048 -nodes -keyout root_ca_false.key -out root_ca_false.pem -days 365 -subj "/CN=RootCA_False" \
    -addext "basicConstraints=CA:FALSE" \
    -addext "keyUsage=keyCertSign,cRLSign,digitalSignature"

# 2. Verify the extensions
openssl x509 -in root_ca_false.pem -text -noout | grep -A2 "Basic Constraints"
openssl x509 -in root_ca_false.pem -text -noout | grep -A2 "Key Usage"
# Output:
#   X509v3 Basic Constraints: critical
#       CA:FALSE
#   X509v3 Key Usage: critical
#       Certificate Sign, CRL Sign, Digital Signature

# 3. Generate a child key and CSR
openssl genrsa -out child.key 2048
openssl req -new -key child.key -out child.csr -subj "/CN=Child"

# 4. Attempt to issue a child certificate using the inconsistent root certificate
openssl x509 -req -in child.csr -CA root_ca_false.pem -CAkey root_ca_false.key -CAcreateserial -out child.crt -days 30


Expected Result
The command should reject the signing request because the issuer certificate has basicConstraints.cA=False. According to RFC 5280, a certificate with cA=FALSE must not be used to sign other certificates, even if keyUsage contains keyCertSign. The expected error message should be similar to:
Error: issuer certificate is not a CA or invalid CA certificate.

Actual Result
The command succeeds and writes a child certificate (child.crt). No error or warning is produced.

Environment
OpenSSL version: 3.0.13 (also reproducible with 1.1.1 and 3.0.x)
Operating system: Ubuntu 22.04 LTS
Command: openssl x509 -req

Attachments
The complete shell script above is the test case. I can also attach the generated certificate files (root_ca_false.pem, child.crt) upon request.

Question
Why does openssl x509 -req allow a certificate with basicConstraints.cA=False to sign a child certificate? According to RFC 5280, such a certificate should not be considered a valid Certificate Authority. Is this behavior intentional, or is it an oversight in the CA constraint validation?

References
RFC 5280, Sections 4.2.1.3 and 4.2.1.9
OpenSSL verify documentation: https://docs.openssl.org/master/man1/openssl-verify/

Start by running the supplied shell reproduction with the affected openssl x509 -req command and inspect the source entry points for that command's issuer handling. Compare its CA constraint checks with RFC 5280 and existing certificate-validation behavior. Done means the command rejects an issuer with basicConstraints=CA:FALSE and a regression test covers the case.