Internet Explorer, Mozilla Firefox, and Google Chrome all respect name constraints. I believe Opera does as well. The issue is that according to RFC5280, nameC

Internet Explorer, Mozilla Firefox, and Google Chrome all respect name constraints. I believe Opera does as well. The issue is that according to RFC5280, nameConstraints MUST be marked critical, which would break all clients that don't support nameConstraints - including Apple OS X and iOS. As a result of not wanting to break these clients, no CA has practically deployed nameConstraints. However, as is being discussed in the CA/Browser Forum AND Mozilla's security policy list (and previously, within PKIX), CAs and browsers are considering diverging from 5280, and not REQUIRING that 5280 be marked critical. ( https://groups.google.com/forum/?fromgroups#!topic/mozilla.dev.security.policy/UgqTBOdGH6s https://groups.google.com/forum/?fromgroups#!topic/mozilla.d... for more context) This will allow a transition period, where CAs that would otherwise NOT include nameConstraints (because it would break clients) can now safely include nameConstraints and not break the legacy or insecure clients that do not support them. Mozilla's proposed CA Certificate Inclusion Policy ( http://www.mozilla.org/projects/security/certs/policy/WorkInProgress/InclusionPolicy.html http://www.mozilla.org/projects/security/certs/policy/WorkIn... ) would REQUIRE that CAs use name constraints when issuing sub-CAs that are not audited, secured, and conformant with Mozilla's policy.