code: public static int getCAPathConstraint(TBSCertificateStructure crt)
              throws IOException {
  
          X509Extensions extensions = crt.getExtensions();
          if (extensions == null) {
              return -1;
          }
          X509Extension proxyExtension =
                  extensions.getExtension(X509Extension.basicConstraints);
          if (proxyExtension != null) {
              BasicConstraints basicExt =
                      getBasicConstraints(proxyExtension);
              if (basicExt.isCA()) {
                  BigInteger pathLen = basicExt.getPathLenConstraint();
                  return (pathLen == null) ? Integer.MAX_VALUE : pathLen.intValue();
              } else {
                  return -1;
              }
          }
          return -1;
      }
docs: Return CA Path constraint
  
  @param crt
  @return the CA path constraint
  @throws IOException