Qualified subordination

https://technet.microsoft.com/en-us/library/cc786077(v=ws.10).aspx

https://technet.microsoft.com/en-us/library/cc785267(v=ws.10).aspx

Using qualified subordination to restrict certificate issuance to specific namespaces

Configuring qualified subordination between two organizations; specifically two configurations:

Allowing trust between all CAs in the two organizations

Limiting trust to specific CAs in the CA hierarchy

Configuring qualified subordination using a bridge CA