[ v3_intermediate ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

nameConstraints = critical, @name_constraints

[ name_constraints ]
permitted;DNS.1 = ixrs.ru
permitted;DNS.2 = .ixrs.ru
permitted;DNS.3 = localhost

permitted;IP.1 = 127.0.0.1/255.255.255.255
permitted;IP.2 = ::1/ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff