憑證機構（CA）憑證之名稱限制（Name Constraints）

CA Certificate Name Constraints

If present, the Name Constraints extension MUST be encoded as follows. As an explicit exception from RFC 5280, this extension SHOULD be marked critical, but MAY be marked non-critical if compatibility with certain legacy applications that do not support Name Constraints is necessary.

若存在，名稱限制（Name Constraints）擴充欄位應（MUST）依下列方式編碼。作為 RFC 5280 之明確例外，本擴充欄位宜（SHOULD）標記為關鍵（critical），但若需與某些不支援名稱限制之舊版應用程式相容，得（MAY）標記為非關鍵（non-critical）。

nameConstraints requirements

Field	Description
permittedSubtrees
GeneralSubtree	The requirements for a GeneralSubtree that appears within a permittedSubtrees.
base	See following table.
minimum	MUST NOT be present.
maximum	MUST NOT be present.
excludedSubtrees
GeneralSubtree	The requirements for a GeneralSubtree that appears within a permittedSubtrees.
base	See following table.
minimum	MUST NOT be present.
maximum	MUST NOT be present.

The following table contains the requirements for the GeneralName that appears within the base of a GeneralSubtree in either the permittedSubtrees or excludedSubtrees.

下表列出 permittedSubtrees 或 excludedSubtrees 中各 GeneralSubtree 之 base 所包含的 GeneralName 要求規定。

GeneralName requirements for the base field

Name Type	Presence	Permitted Subtrees	Excluded Subtrees
dNSName	MAY	The CA MUST confirm that the Applicant has registered the dNSName or has been authorized by the domain registrant to act on the registrant’s behalf. See Section 3.2.2.4.	If at least one dNSName instance is present in the permittedSubtrees, the CA MAY indicate one or more subordinate domains to be excluded.
iPAddress	MAY	The CA MUST confirm that the Applicant has been assigned the iPAddress range or has been authorized by the assigner to act on the assignee’s behalf. See Section 3.2.2.5.	If at least one iPAddress instance is present in the permittedSubtrees, the CA MAY indicate one or more subdivisions of those ranges to be excluded.
directoryName	MAY	The CA MUST confirm the Applicant’s and/or Subsidiary’s name attributes such that all certificates issued will comply with the relevant Certificate Profile (see Section 7.1.2), including Name Forms (See Section 7.1.4).	It is NOT RECOMMENDED to include values within excludedSubtrees.
rfc822Name	NOT RECOMMENDED	The CA MAY constrain to a mailbox, a particular host, or any address within a domain, as specified within RFC 5280, Section 4.2.1.10. For each host, domain, or Domain portion of a Mailbox (as specified within RFC 5280, Section 4.2.1.6), the CA MUST confirm that the Applicant has registered the domain or has been authorized by the domain registrant to act on the registrant’s behalf. See Section 3.2.2.4.	If at least one rfc822Name instance is present in the permittedSubtrees, the CA MAY indicate one or more mailboxes, hosts, or domains to be excluded.
otherName	NOT RECOMMENDED	See below	See below
Any other value	NOT RECOMMENDED	-	-

Any otherName, if present:

任何 otherName，若存在：

1. MUST apply in the context of the public Internet, unless:
   1. the type-id falls within an OID arc for which the Applicant demonstrates ownership, or,
   2. the Applicant can otherwise demonstrate the right to assert the data in a public context.
2. MUST NOT include semantics that will mislead the Relying Party about certificate information verified by the CA.
3. MUST be DER encoded according to the relevant ASN.1 module defining the otherName type-id and value.

1. 應（MUST）適用於公共網際網路，除非：
   1. type-id 位於申請者能證明擁有其所有權之 OID arc 範圍內，或
   2. 申請者能以其他方式證明其有權於公共網際網路中聲明該資料。
2. 不得（MUST NOT）具有可能使信賴憑證者對 CA 所驗證之憑證資訊產生誤解的含義。
3. 應（MUST）依相關 ASN.1 模組中對該 otherName 的 type-id 與 value 之定義，以 DER 進行編碼。

CAs SHALL NOT include additional names unless the CA is aware of a reason for including the data in the Certificate.

CA 不得（SHALL NOT）包含額外名稱（例如額外的 GeneralName），除非 CA 知悉有正當理由於憑證中包含該資料。