I completely agree that nameconstraints are going to become a bigger deal, likely in the next 12-24 months, and certainly during the peak usage time of OpenSSL 1.1 -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=3502 Please log in as guest with password guest if prompted