NameConstraints

These constraints apply both to the subject and also to any SubjectAlternativeNames that may be present. Restrictions are applied to specific name forms, and when the form is not present then the restriction does not apply.

Restrictions are defined in terms of both permitted and forbidden subtrees. The forbidden trees are consulted first, and if a name is matched in a forbidden tree then it does not matter whether the same name is also matched in a permitted tree.