TLS certificate management on Android

Did you (or anyone else reading this) get nameConstraints working across a solid majority of browsers? I couldn’t… and I’d really like to have our own internal CA constrained to internal names.

These intranet services are the main holdouts here that don’t have Letsencrypt certs on them. The other being stupid appliances where automation is neigh-impossible, and you’d have to click through a daft web-interface every three months to update the certificate.