same constraints as cmd cert