diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0e061fc77..851c0eed7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2085,6 +2085,7 @@ if(WOLFSSL_TPM)
     override_cache(WOLFSSL_CERTEXT  "yes")
     override_cache(WOLFSSL_PKCS7    "yes")
     override_cache(WOLFSSL_AESCFB   "yes")
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALLOW_ENCODING_CA_FALSE")
 endif()
 
 if(WOLFSSL_CLU)
diff --git a/configure.ac b/configure.ac
index 21dfb0c79..9334d3cd5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -7243,6 +7243,9 @@ then
 
     # Requires public mp_
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_PUBLIC_MP"
+
+    # Requires allowing CA:FALSE in BasicConstraints
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ALLOW_ENCODING_CA_FALSE"
 fi
 
 if test "x$ENABLED_SMIME" = "xyes"