Some CAs are limited in the way you describe. For instance, this just came up a few days ago: https://groups.google.com/a/mozilla.org/g/dev-security-polic...