Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.7.4 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/cyli/Go"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.7.4/libexec"
GOTOOLDIR="/usr/local/Cellar/go/1.7.4/libexec/pkg/tool/darwin_amd64"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/v9/wzpq8hm56b943960j1qrnblm0000gp/T/go-build860790401=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"

What did you do?

I parsed a CA certificate which did not have pathLenConstraint set: https://play.golang.org/p/lFCQJQPRLh

What did you expect to see?

Given the following comment in https://golang.org/pkg/crypto/x509/#Certificate:

        // MaxPathLenZero indicates that BasicConstraintsValid==true and
        // MaxPathLen==0 should be interpreted as an actual maximum path length
        // of zero. Otherwise, that combination is interpreted as MaxPathLen
        // not being set.

and that RFC5280 4.2.1.9 specifies that the pathLenConstraint must be >= 0, I expected to see MaxPathLen as 0 and MaxPathLenZero as false.

What did you see instead?

MaxPathLen was -1 and MaxPathLenZero was false.

I don't oppose using -1 to indicate that it wasn't set, but comments for MaxPathLen, etc. imply that -1 is not valid. If -1 is a valid value, should the docs be updated and possibly MaxPathLenZero be deprecated?