code: public void setNameConstraints(byte[] bytes) throws IOException {
          if (bytes == null) {
              ncBytes = null;
              nc = null;
          } else {
              ncBytes = bytes.clone();
              nc = new NameConstraintsExtension(FALSE, bytes);
          }
      }
docs: Sets the name constraints criterion. The {@code X509Certificate}
  must have subject and subject alternative names that
  meet the specified name constraints.
  <p>
  The name constraints are specified as a byte array. This byte array
  should contain the DER encoded form of the name constraints, as they
  would appear in the NameConstraints structure defined in RFC 3280
  and X.509. The ASN.1 definition of this structure appears below.
  
  <pre>{@code
  NameConstraints ::= SEQUENCE {
  permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
  excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
  
  GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
  
  GeneralSubtree ::= SEQUENCE {
  base                    GeneralName,
  minimum         [0]     BaseDistance DEFAULT 0,
  maximum         [1]     BaseDistance OPTIONAL }
  
  BaseDistance ::= INTEGER (0..MAX)
  
  GeneralName ::= CHOICE {
  otherName                       [0]     OtherName,
  rfc822Name                      [1]     IA5String,
  dNSName                         [2]     IA5String,
  x400Address                     [3]     ORAddress,
  directoryName                   [4]     Name,
  ediPartyName                    [5]     EDIPartyName,
  uniformResourceIdentifier       [6]     IA5String,
  iPAddress                       [7]     OCTET STRING,
  registeredID                    [8]     OBJECT IDENTIFIER}
  }</pre>
  <p>
  Note that the byte array supplied here is cloned to protect against
  subsequent modifications.
  
  @param bytes a byte array containing the ASN.1 DER encoding of
  a NameConstraints extension to be used for checking
  name constraints. Only the value of the extension is
  included, not the OID or criticality flag. Can be
  {@code null},
  in which case no name constraints check will be performed.
  @throws IOException if a parsing error occurs
  @see #getNameConstraints