Javadoc
Apply the name restrictions specified by this NameConstraints
instance to the subject distinguished name and subject alternative
names of specified X509Certificate. Restrictions apply only
if specified name form is present in the certificate.
The restrictions are applied according the RFC 3280
(see 4.2.1.11 Name Constraints), excepting that restrictions are applied
and to CA certificates, and to certificates which issuer and subject
names the same (i.e. method does not check if it CA's certificate or not,
or if the names differ or not. This check if it is needed should be done
by caller before calling this method).