Yes, they are. The extension should be marked as critical, so if the client does not understand it it should error out. At least java, go, curl and all major browser support it.
X.509 Name Constraints extension is what you are looking for. They are VERY expensive when ordered from public CA, but we use them at work for internal PKI.
I wonder whether it runs under http://manuels.github.io/texlive.js/
Yes, they are. The extension should be marked as critical, so if the client does not understand it it should error out. At least java, go, curl and all major browser support it.
X.509 Name Constraints extension is what you are looking for. They are VERY expensive when ordered from public CA, but we use them at work for internal PKI.
I wonder whether it runs under http://manuels.github.io/texlive.js/