https://docs.openssl.org/3.5/man1/

https://www.golinuxcloud.com/add-x509-extensions-to-certificate-openssl/

https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html

https://www.youtube.com/watch?v=StTKqLeJ7Ms