I mean that they do not properly validate / IIRC, they raise validation errors when they should successfully validate. > nameConstraints in a root cert I'm ta

I mean that they do not properly validate / IIRC, they raise validation errors when they should successfully validate. > nameConstraints in a root cert I'm talking about nameConstraints in a non-root certificate; IDK if this has an effect on how browsers would or would not validate it. My comment is simply "last time I tried it, it didn't work." It was a few years back, so perhaps I should try it again.