What is preventing this from turning into another "Turktrust fiasco?" Is the delegated signing privilege only valid for explicit DNS names?
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ss...
The delegated credential is not another cerificate and doesn't have a DNS name in it at all. The original certificate who's private key was used to create the delegated credential still has that information and the client still gets that. The delegated credential only consists of four pieces of information: validity interval, public key, signature algorithm and signature. I.E. just enough information to provide the public key and verify it is signed by the CA signed certificate.
RFC is here if you want to read the details: https://tools.ietf.org/html/draft-ietf-tls-subcerts-04