IPA no verifies that intermediate certs of external CAs have a basic constraint path len of at least 1 and increasing. Fixes: https://pagure.io/freeipa/issue/7877 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Fraser Tweedale <ftweedal@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>