Updated test for name constraints to include empty constraints names.

diff --git a/tests/cert-tests/template-nc.pem b/tests/cert-tests/template-nc.pem
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tests/cert-tests/template-nc.tmpl b/tests/cert-tests/template-nc.tmpl
index d1eb7169527de8e7df7087847b5387453c5900be..a93a0690f9d5aee43c88f454b29fd3af6120776b 100644 (file)
--- a/tests/cert-tests/template-nc.tmpl
+++ b/tests/cert-tests/template-nc.tmpl
@@ -52,6 +52,9 @@ nc_permit_dns = example.com
 nc_exclude_dns = net
 nc_exclude_dns = org
 
+#empty DNS means that subordinates cannot sign certs with DNS names
+nc_exclude_dns = ''
+
 nc_permit_email = nmav@example.com
 nc_exclude_email = example.net
 nc_exclude_email = example.li