3.2.2 Under Note : PermittedSubtrees within the nameConstraints extension contains domain name

[AshishGlobalSign]

Current Text : Note: Mailbox Fields MAY be listed in Subscriber Certificates using rfc822Name or otherNames of type id-on-SmtpUTF8Mailbox in the subjectAltName extension, or in Subordinate CA Certificates via rfc822Name in permittedSubtrees within the nameConstraints extension.

Question : There is no description about excluded subtrees, and also audience may try to include (a part of) mail address even though permitted/excludedSubtrees can only include (a part of) domain name in rfc822Name according to RFC 5280

So this need to be fixed, and specified here like is Email info will be added here or part of domain name in rfc822 Name ?

[CBonnell]

Is an allowance for individual mailbox addresses in nameConstraints actually needed, or is more of a theoretical concern? I've never seen a CA certificate with constraints on individual mailbox addresses.

[srdavidson]

Closing; will not implement.