[Swan] subdomain certs not accepted

[Marc]

> 
> > >
> > > Working with the CA of the example on this page[1]
> > >
> > > certutil -S -x -n "Example CA" -s "O=Example,CN=Example CA" \
> > > -k rsa -g 4096 -v 12 -d sql:${HOME}/tmpdb -t "CT,," -2
> > >
> > > certs xxx.example.com are accepted however aaa.bbbb.example.com seem to
> be
> > reject.
> >
> > Why? Did you specify constrains in the rightid= ?
> 

I was just blind, added incorrect Key usage.