[ v3_intermediate ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

nameConstraints = critical, permit;DNS:ixrs.ru, permit;DNS:.ixrs.ru
# Разрешает домен ixrs.ru, localhost и локальные IP-адреса
nameConstraints = critical, permit;DNS:ixrs.ru, permit;DNS:.ixrs.ru, permit;DNS:localhost, permit;IP:127.0.0.1/255.255.255.255, permit;IP:0:0:0:0:0:0:0:1/128