Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browser

Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...