Yes, I do it in my work to restrict my company CA to company servers [1]. You generate your own CA, and cross sign other cert with any constraint you want. It works great, but requires some setup, and of course now you have your own personal CA to worry about.

[1] Yes, company is ok with it, most of my team does it, and this makes everyone more secure. Win-win.