Decodes the Name Constraints certificate extension on the CA cert
and checks the names on the peer cert, rejecting it if invalid
based on the name.
Merge branch 'frankencert'