# What Is Name Constraints (nameConstraints extension)?

> Name Constraints is an X.509 extension in CA certificates that limits which names (DNS, IP, email, DN) any certificate issued beneath that CA may contain.

Source: https://ssl.sh/glossary/name-constraints/
Last updated: 2026-11-10

Name Constraints, defined in RFC 5280, contains `permittedSubtrees` and `excludedSubtrees`. A verifier applies them to every certificate below the constrained CA in the chain: each name in the subject and [SAN](https://ssl.sh/glossary/san/) must fall inside a permitted subtree and outside every excluded one. For DNS names, a constraint of `example.com` matches `example.com` itself and any subdomain such as `api.example.com`; IP constraints are written as an address and a mask.

## Why it matters
Name constraints turn a CA into a technically limited one. An organization can operate a [subordinate CA](https://ssl.sh/glossary/subordinate-ca/) permitted to issue only for its own domains, or a [private CA](https://ssl.sh/glossary/private-ca/) whose root, once installed on laptops, cannot be used to impersonate outside websites. That makes trusting a partner's or vendor's internal root far less risky. Support has historically been uneven across platforms and TLS libraries, so test the clients you care about before relying on it.

## Example
```text
nameConstraints = critical, permitted;DNS:example.com, permitted;IP:10.0.0.0/255.0.0.0
```

In an OpenSSL extension section, this limits a CA to `example.com`, its subdomains and the 10.0.0.0/8 network.

## Common misconceptions
- **Name constraints belong in leaf certificates.** They only have meaning in CA certificates, where they restrict what is issued below.
- **A constraint on example.com excludes its subdomains.** For DNS names it covers the domain and every name under it.
- **Name constraints stop the CA from signing other names.** The CA can still sign anything; it is relying parties that reject out-of-scope certificates, so client support is what counts.

## Related terms

- [下级 CA](https://ssl.sh/zh/glossary/subordinate-ca/): 下级 CA 是 CA 证书由另一个 CA（通常是根 CA）签发的证书颁发机构，一般负责实际签发终端证书。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。
- [基本约束](https://ssl.sh/zh/glossary/basic-constraints/): 基本约束是 X.509 证书扩展，用来声明该证书是否属于 CA，以及其下方还允许出现多少层 CA。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [EKU](https://ssl.sh/zh/glossary/extended-key-usage/): EKU 即扩展密钥用途，是列出证书可用于哪些目的（如 serverAuth 服务器认证、clientAuth 客户端认证、代码签名）的 X.509 扩展。