I'm trying to set permitted name constraints on a private CA certificate. For example, I have the following constraints on my root certificate
X509v3 Name Constraints: critical Permitted: DNS:.mytestdomain.local DNS:mytestdomain.local
I've issued a certificate for another domain
anothertestdomain.local. Both the Common Name and Subject Alternative Names are set to that domain. When testing validation for that certificate, OpenSSL and Firefox both fail with a Permitted Subtree Violation as expected. Chrome, however, accepts that certificate. Is this expected under Chrome?
I'm testing with Chromium on Linux.