KeyCertSign is a KeyUsage bit
that is asserted when the Certificate Subject Public Key
is used for verifying Digital Signature
on Public Key certificates
KeyCertSign bit requires the cA bit in the basic constraints extension (RFC 5280 Section 18.104.22.168) MUST also be asserted.
There might be more information for this subject on one of the following: