diff --git a/Data/X509/Validation.hs b/Data/X509/Validation.hs
--- a/Data/X509/Validation.hs
+++ b/Data/X509/Validation.hs
@@ -132,6 +132,11 @@
             | otherwise =
                 (\x -> (x, filter (/= x) chain)) `fmap` find (matchSI issuerDN) chain
 
+        -- we check here that the certificate is allowed to be a certificate
+        -- authority, by checking the BasicConstraint extension. We also check,
+        -- if present the key usage extension for ability to cert sign. If this
+        -- extension is not present, then according to RFC 5280, it's safe to
+        -- assume that only cert sign (and crl sign) are allowed by this certificate.
         checkCA :: Certificate -> [FailedReason]
         checkCA cert
             | allowedSign && allowedCA = []
@@ -140,7 +145,7 @@
           where extensions  = (certExtensions cert)
                 allowedSign = case extensionGet extensions of
                                 Just (ExtKeyUsage flags) -> KeyUsage_keyCertSign `elem` flags
-                                Nothing                  -> False
+                                Nothing                  -> True
                 allowedCA   = case extensionGet extensions of
                                 Just (ExtBasicConstraints True _) -> True
                                 _                                 -> False
diff --git a/x509-validation.cabal b/x509-validation.cabal
--- a/x509-validation.cabal
+++ b/x509-validation.cabal
@@ -1,5 +1,5 @@
 Name:                x509-validation
-Version:             1.4.3
+Version:             1.4.4
 Description:         X.509 Certificate and CRL validation
 License:             BSD3
 License-file:        LICENSE