Valid and invalid certificates using name constraints. From
https://cabforum.org/pipermail/public/2013-July/001839.html.