code: func appendCAInfoToCSR(reqConf *CAConfig, csr *x509.CertificateRequest) error {
  	pathlen := reqConf.PathLength
  	if pathlen == 0 && !reqConf.PathLenZero {
  		pathlen = -1
  	}
  	val, err := asn1.Marshal(BasicConstraints{true, pathlen})
  
  	if err != nil {
  		return err
  	}
  
  	csr.ExtraExtensions = []pkix.Extension{
  		{
  			Id:       asn1.ObjectIdentifier{2, 5, 29, 19},
  			Value:    val,
  			Critical: true,
  		},
  	}
  
  	return nil
  }
docs: // appendCAInfoToCSR appends CAConfig BasicConstraint extension to a CSR