NameConstraints

NameConstraints is an X.509 v3 certificate extension used by certificate authorities to limit the set of names that may appear in certificates issued under a given CA. It enables an authority to define the scope of acceptable names for any subordinate certificates, thereby reducing the risk of certificates being issued for unintended domains, email addresses, or directory names.

The extension defines two optional fields: permittedSubtrees and excludedSubtrees. Each field contains a sequence of GeneralSubtree entries. A GeneralSubtree specifies a base name (a GeneralName) and optionally minimum and maximum distance constraints. In practice, implementations often focus on the base name. The relevant name types include dNSName (DNS domains), rfc822Name (email addresses), directoryName (X.500 distinguished names), and other GeneralName types. Name constraints apply to both the subject distinguished name and the subjectAltName extensions of subsequent certificates issued by the CA.

Processing rules are applied during path validation. If permittedSubtrees is present, every name in a certificate’s subject name or subjectAltName must fall within at least one of the permitted subtrees; if a name matches any excludedSubtree, the constraint is violated. If a subordinate certificate would introduce a name outside the permitted set or inside an excluded subtree, the certificate chain may be rejected.

NameConstraints are defined in RFC 5280 and are commonly used in enterprise PKI and in some public PKI deployments to tighten control over issued certificates. Compatibility varies across implementations, so testing is important to ensure proper enforcement without unintended certificate rejection.