---
name: "libressl-NAME_CONSTRAINTS_new"
section: "3"
platform: "linux"
package: "libressl"
version: "4.4.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libressl-NAME_CONSTRAINTS_new"
---

# libressl-NAME\_CONSTRAINTS\_new(3)

X.509 CA name constraints extension

## NAME

**NAME\_CONSTRAINTS\_new**, **NAME\_CONSTRAINTS\_free**, **GENERAL\_SUBTREE\_new**, **GENERAL\_SUBTREE\_free** – X.509 CA name constraints extension

## SYNOPSIS

Crypto Library (libcrypto, -lcrypto)

**#include \<openssl/x509v3.h\>**

*NAME\_CONSTRAINTS* *\**\

**NAME\_CONSTRAINTS\_new**(*void*);

*void*\

**NAME\_CONSTRAINTS\_free**(*NAME\_CONSTRAINTS \*names*);

*GENERAL\_SUBTREE* *\**\

**GENERAL\_SUBTREE\_new**(*void*);

*void*\

**GENERAL\_SUBTREE\_free**(*GENERAL\_SUBTREE \*name*);

## DESCRIPTION

X.509 CA certificates can use the name constraints extension to restrict the subject names of subsequent certificates in a certification path.

**NAME\_CONSTRAINTS\_new**() allocates and initializes an empty *NAME\_CONSTRAINTS* object, representing an ASN.1 *NameConstraints* structure defined in RFC 5280 section 4.2.1.10. It consists of two *STACK\_OF(GENERAL\_SUBTREE)* objects, one specifying permitted names, the other excluded names. **NAME\_CONSTRAINTS\_free**() frees *names*.

**GENERAL\_SUBTREE\_new**() allocates and initializes an empty *GENERAL\_SUBTREE* object, representing an ASN.1 *GeneralSubtree* structure defined in RFC 5280 section 4.2.1.10. It is a trivial wrapper around the *GENERAL\_NAME* object documented in GENERAL\_NAME\_new(3). The standard requires the other fields of *GENERAL\_SUBTREE* to be ignored. **GENERAL\_SUBTREE\_free**() frees *name*.

## RETURN VALUES

**NAME\_CONSTRAINTS\_new**() and **GENERAL\_SUBTREE\_new**() return the new *NAME\_CONSTRAINTS* or *GENERAL\_SUBTREE* object, respectively, or NULL if an error occurs.

## SEE ALSO

BASIC\_CONSTRAINTS\_new(3), GENERAL\_NAMES\_new(3), X509\_EXTENSION\_new(3), X509\_new(3)

## STANDARDS

RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, section 4.2.1.10: Name Constraints

## HISTORY

**NAME\_CONSTRAINTS\_new**(), **NAME\_CONSTRAINTS\_free**(), **GENERAL\_SUBTREE\_new**(), and **GENERAL\_SUBTREE\_free**() first appeared in OpenSSL 0.9.8 and have been available since OpenBSD 4.5.