Comment by pritambaral

Does this generate root CAs with NameConstraints[1] set? Because otherwise, the root CAs could issue a trusted cert for _any_ domain on the internet.

1: https://nameconstraints.bettertls.com/#!about