There is a Name Constraints extension in X.509[1] that does exactly that, but to my knowledge no browser implements it.
Firefox does, though I don't know how much they check beyond just the dNSName constraints. Here's the unit test making sure it stays working: https://github.com/mozilla/gecko-dev/blob/b8157dfaafc42deb3b...