The dirname constraint must be a prefix in DER format, so relax the
check from requiring equal-length strings to allow shorter names also.

From Alex Wilson

ok jsing