CA-Path-Length

Use this parameter to specify the maximum permitted length of the hierarchy of sub-CAs below the root CA (length of the "chain of trust").

A value of 1 means that only the root CA can issue certificates for sub-CAs. Sub-CAs themselves cannot issue certificates to other sub-CAs and so extend the "chain of trust". When set to 0, not even the root CA is capable of issuing certificates for sub-CAs. In this case, the root CA can only sign end-user certificates.