code: private void verifyNameConstraints(X509Certificate currCert)
          throws CertPathValidatorException
      {
          String msg = "name constraints";
          if (debug != null) {
              debug.println("---checking " + msg + "...");
          }
  
          // check name constraints only if there is a previous name constraint
          // and either the currCert is the final cert or the currCert is not
          // self-issued
          if (prevNC != null && ((i == certPathLength) ||
                  !X509CertImpl.isSelfIssued(currCert))) {
              if (debug != null) {
                  debug.println("prevNC = " + prevNC +
                      ", currDN = " + currCert.getSubjectX500Principal());
              }
  
              try {
                  if (!prevNC.verify(currCert)) {
                      throw new CertPathValidatorException(msg + " check failed",
                          null, null, -1, PKIXReason.INVALID_NAME);
                  }
              } catch (IOException ioe) {
                  throw new CertPathValidatorException(ioe);
              }
          }
  
          // merge name constraints regardless of whether cert is self-issued
          prevNC = mergeNameConstraints(currCert, prevNC);
  
          if (debug != null)
              debug.println(msg + " verified.");
      }
docs: Internal method to check the name constraints against a cert