// against name constraints, while we ignore it when it's not hostname-looking.
			if !test.noOpenSSL && testNameConstraintsAgainstOpenSSL && test.leaf.cn == "" {
				output, err := testChainAgainstOpenSSL(t, leafCert, intermediatePool, rootPool)
				if err == nil && len(test.expectedError) > 0 {
					t.Error("unexpectedly succeeded against OpenSSL")
					if debugOpenSSLFailure {
						return
					}