diff --git a/src/pki/name_constraints.cc b/src/pki/name_constraints.cc
index f96af92f2..73d87aa4e 100644
--- a/src/pki/name_constraints.cc
+++ b/src/pki/name_constraints.cc
@@ -288,6 +288,17 @@ std::unique_ptr<NameConstraints> NameConstraints::Create(
   return name_constraints;
 }
 
+std::unique_ptr<NameConstraints> NameConstraints::CreateFromPermittedSubtrees(
+    GeneralNames permitted_subtrees) {
+  auto name_constraints = std::make_unique<NameConstraints>();
+
+  name_constraints->constrained_name_types_ =
+      permitted_subtrees.present_name_types;
+  name_constraints->permitted_subtrees_ = std::move(permitted_subtrees);
+
+  return name_constraints;
+}
+
 bool NameConstraints::Parse(der::Input extension_value, bool is_critical,
                             CertErrors *errors) {
   BSSL_CHECK(errors);
diff --git a/src/pki/name_constraints.h b/src/pki/name_constraints.h
index f363849d4..a025985fe 100644
--- a/src/pki/name_constraints.h
+++ b/src/pki/name_constraints.h
@@ -35,6 +35,11 @@ class OPENSSL_EXPORT NameConstraints {
                                                  bool is_critical,
                                                  CertErrors *errors);
 
+  // Create a NameConstraints object with only permitted names from the passed
+  // in |permitted_subtrees|. Should never return nullptr.
+  static std::unique_ptr<NameConstraints> CreateFromPermittedSubtrees(
+      GeneralNames permitted_subtrees);
+
   // Tests if a certificate is allowed by the name constraints.
   // |subject_rdn_sequence| should be the DER-encoded value of the subject's
   // RDNSequence (not including Sequence tag), and may be an empty ASN.1