&gt; Isn&#x27;t it possible for a CA cert to have authority only for *.foo.com?<p>Technically, you can do that with name constraints. In practice, you can&#x27;t because many SSL implementations (like, say, OpenSSL[0]) won&#x27;t honour it, so it&#x27;d effectively be an unrestricted root CA for those.<p>[0] <a href="http:&#x2F;&#x2F;blog.codekills.net&#x2F;2012&#x2F;04&#x2F;08&#x2F;adventures-in-x509-the-utterly-ignored-nameconstraints&#x2F;" rel="nofollow">http:&#x2F;&#x2F;blog.codekills.net&#x2F;2012&#x2F;04&#x2F;08&#x2F;adventures-in-x509-the-...</a>