diff --git a/Network/TLS/Extra/Certificate.hs b/Network/TLS/Extra/Certificate.hs
--- a/Network/TLS/Extra/Certificate.hs
+++ b/Network/TLS/Extra/Certificate.hs
@@ -89,7 +89,7 @@
           checkCA (Just es) =
               let kuCanCertSign = case extensionGet es of
                                       Just (ExtKeyUsage l) -> elem KeyUsage_keyCertSign l
-                                      Nothing              -> False
+                                      Nothing              -> True
                in case extensionGet es of
                     Just (ExtBasicConstraints True _)
                                            | kuCanCertSign -> Nothing
diff --git a/tls-extra.cabal b/tls-extra.cabal
--- a/tls-extra.cabal
+++ b/tls-extra.cabal
@@ -1,5 +1,5 @@
 Name:                tls-extra
-Version:             0.6.3
+Version:             0.6.4
 Description:
    a set of extra definitions, default values and helpers for tls.
 License:             BSD3