[1] RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
( 版)
http://tools.ietf.org/html/rfc5280#section-3.2
End entity certificates
are issued to subjects that are not authorized to issue certificates.