@Test
    public void testBasicConstraints() {
        ServiceTester tester = ServiceTester.test("CertificateFactory").withAlgorithm("X509");
        tester.run((p, algorithm) -> {
            // Test some additional edge cases in getBasicConstraints() beyond that
            // testManyExtensions() and testV1Cert() covered.

            // If there is no pathLen constraint but the certificate is a CA,
            // getBasicConstraints() returns Integer.MAX_VALUE.
            X509Certificate c = certificateFromPEM(p, BASIC_CONSTRAINTS_NO_PATHLEN);
            assertEquals(Integer.MAX_VALUE, c.getBasicConstraints());

            // If there is a pathLen constraint of zero, getBasicConstraints() returns it.
            c = certificateFromPEM(p, BASIC_CONSTRAINTS_PATHLEN_0);
            assertEquals(0, c.getBasicConstraints());

            // If there is basicConstraints extension indicating a leaf certficate,
            // getBasicConstraints() returns -1. The accessor does not distinguish between no
            // basicConstraints extension and a leaf one.
            c = certificateFromPEM(p, BASIC_CONSTRAINTS_LEAF);
            assertEquals(-1, c.getBasicConstraints());

            // If some unrelated extension has a syntax error, and that syntax error does not
            // fail when constructing the certificate, it should not interfere with
            // getBasicConstraints().
            try {
                c = certificateFromPEM(p, BASIC_CONSTRAINTS_PATHLEN_10_BAD_SAN);
            } catch (CertificateParsingException e) {
                // The certificate has a syntax error, so it would also be valid for the
                // provider to reject the certificate at construction. X.509 is an extensible
                // format, so different implementations may notice errors at different points.
                c = null;
            }
            if (c != null) {
                assertEquals(10, c.getBasicConstraints());
            }
        });
    }
Confirm that explicit EC params aren't accepted in certificates.
common/src/test/java/org/conscrypt/java/security/cert/X509CertificateTest.java