I use that extensively on a bunch of private CAs, know though that it can sometimes be a touch quirky. For example, certain applications/libraries will apparently look for anything that "looks like it has a domain in it" in the cert and check it against the constraint, so for example if you have a root CA with a constraint to only abc.com but then have the admin contact email set as [email protected] it'll complain even though browsers are fine. This is clearly a bug but it's been floating around for a long time (though I haven't checked in a while granted).

And I always do [root ca] > [intermediate online ca] > [more specific constrained cas if required] with root kept fully offline and the intermediate one used for online signing convenience.

Overall I think doing one's own CA is unnecessarily irritating to get into, plenty of very strange behavior in openssl and how everything interacts, irritating to learn and keep up with best practices, and of course it's a lot harder to get things trusted for a domain that you own then it should be. I wish the whole ecosystem there was a lot better because it's one of the key bits of gatekeeping/centralization/privacy. Let's Encrypt helps but is specifically for public websites, not other usage. Even so it's still very useful to have that power and flexibility for nothing, and there are capabilities in extensions to help enforce better practices.

> you can mitigate around that by keeping your root cert offline.

This is something you should probably do anyways.

And MacOS supports them finally since High Sierra