Step CA fails to load CA containing RFC822 name constraints

[wasabii]

Subject of the issue

Step CA fails to load CA containing RFC822 name constraints.

Your environment

• OS - Linux
• Version - 0.14.3

Steps to reproduce

Produce a CA certificate using the Name Constraint extension, allowing a RFC822 constraint of @domain.com. Attempt to start Step CA using this CA certificate.

Expected behaviour

Step CA should start properly.

Actual behaviour

x509: failed to parse rfc822Name constraint "@domain.com"
error parsing /home/step/certs/intermediate_ca.crt
github.com/smallstep/cli/crypto/pemutil.Parse
	/home/travis/gopath/pkg/mod/github.com/smallstep/cli@v0.14.2/crypto/pemutil/pem.go:285
github.com/smallstep/cli/crypto/pemutil.Read
	/home/travis/gopath/pkg/mod/github.com/smallstep/cli@v0.14.2/crypto/pemutil/pem.go:319
github.com/smallstep/cli/crypto/pemutil.ReadCertificate
	/home/travis/gopath/pkg/mod/github.com/smallstep/cli@v0.14.2/crypto/pemutil/pem.go:172
github.com/smallstep/certificates/authority.(*Authority).init
	/home/travis/gopath/src/github.com/smallstep/certificates/authority/authority.go:151

[maraino]

According to RFC5280@domain.com is not a valid mail address, if you want to specify all the address in a domain this value has to be domain.com

   A name constraint for Internet mail addresses MAY specify a
   particular mailbox, all addresses at a particular host, or all
   mailboxes in a domain.  To indicate a particular mailbox, the
   constraint is the complete mail address.  For example,
   "root@example.com" indicates the root mailbox on the host
   "example.com".  To indicate all Internet mail addresses on a
   particular host, the constraint is specified as the host name.  For
   example, the constraint "example.com" is satisfied by any mail
   address at the host "example.com".  To specify any address within a
   domain, the constraint is specified with a leading period (as with
   URIs).  For example, ".example.com" indicates all the Internet mail
   addresses in the domain "example.com", but not Internet mail
   addresses on the host "example.com".