[nh2]

See this for a simple CA tutorial script including Name Constraints using only OpenSSL:

https://github.com/nh2/internal-contstrained-pki