The fact that 3) was not built-in from the start pains me to no end. It should be flying first-class with Priority Airlines, a penthouse in the Hilton bugtracker since 1996. Instead, it's #3 in someone's list somewhere in a forum in 2015.
Oh my God! What? How is this not a major, major thing? How are Mozilla and Google not pushing hard for government CAs to have these, like, stat? And for OpenSSL to actually check them?
I am bewildered. What happened? Is this just apathy?
Enforcement of nameConstraints is inconsistent at best.
I experimented with name constraints a couple years ago for a private CA project, with the idea that I could restrict the private CA to issuing only names within a chosen subdomain.
I remember being able to enforce nameConstraints on the subjectAltName, but I was never able to get it to enforce anything on the subject Common Name. In theory new certificates should always have a critical subjectAltName extension, but this makes it worthless in practice.
It's also possible that my X.509 foo is not strong enough, or that I was testing with an older version of OpenSSL that doesn't implement it.
