private function _processBasicContraints(Certificate $cert)
    {
        if ($cert->tbsCertificate()->version() == TBSCertificate::VERSION_3) {
            $extensions = $cert->tbsCertificate()->extensions();
            if (!$extensions->hasBasicConstraints()) {
                throw new PathValidationException(
                    "v3 certificate must have basicConstraints extension.");
            }
            // verify that cA is set to TRUE
            if (!$extensions->basicConstraints()->isCA()) {
                throw new PathValidationException(
                    "Certificate is not a CA certificate.");
            }
        }
    }