Set certificate lifetime as specified, not 365.
Makefile negative test should actually fail on success, not echo
If default ecc curve secp224k1 isn't there, use secp384r1.  Also document ecc keylen.
Add nameconstraint certificate options.

Note that nameConstraints are not yet globally supported.
Add multiple nameconstraint certificate support