@CryptoGuy had a pretty good answer here, but I wanted to expand on it.
You can restrict 3rd party CA to trust certificates (from that CA) issued to a name list you wish.
Even if 3rd party CA do not have Name Constraints extension, it is possible to apply them by using your own internal CA server via cross-certification.
The trick is that you sign 3rd party CA by using your internal CA.
leaf SSL cert -> cross-certificate -> your CA certificate -> your internal root certificate.
And here's how you make that work (using OpenSSL command line CA)
Create a simple CA
openssl req -new -x509 -days 3650 -newkey rsa:2048 -sha256 -out root-ca.crt -keyout root-ca.key -subj "/CN=My Root CA"
You may skip creating an intermediate CA
Create an intermediate CA request, with Name Constraints.
openssl req -new -days 3650 -newkey rsa:2048 -out domain-ca.req -sha256 -keyout domain-ca.key -config ossl_domain_com.cfg
With this in the
[ req ]
[ req_distinguished_name ]
CN=somedomain.com trust CA
[ domain_ca ]
Then, sign that Intermediate domain CA with your CA.
openssl x509 -req -in domain-ca.req -CA root-ca.crt -CAkey root-ca.key -sha256 -set_serial 1 -out domain-ca.crt -extensions domain_ca -extfile ossl_domain_com.cfg
If you skipped creating the intermediate, use your root CA to sign
Now re-sign the original domain's CA under your authority, using their certificate. You can add the CA extensions here.
openssl x509 -in third_party_ca.crt -CA domain-ca.crt -CAkey domain-ca.key -set_serial 47 -sha256 -extensions domain_ca -extfile ossl_domain_com.cfg -out domain-cross-ca.crt
You may need to use the
-x509-to-req argument to create a request, which you'd sign exactly the same way as the intermediate above.
Now, add your root CA, intermediate CA, and the domain-cross-ca to your browser's trust database.