Add a cert which complies with the name constraints but has no SAN extension Reviewed-by: Tomas Mraz <tomas@openssl.org>