Supposedly name constraints are not universally supported though.

See:

http://security.stackexchange.com/questions/31376/certificat...

http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...