Supposedly name constraints are not universally supported though. See: http://security.stackexchange.com/questions/31376/certification-authority-limited-only-

Supposedly name constraints are not universally supported though. See: http://security.stackexchange.com/questions/31376/certification-authority-limited-only-to-certain-domains http://security.stackexchange.com/questions/31376/certificat... http://blog.codekills.net/2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/ http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...