Many big websites use their own intermediate signing certificates to generate SSL certificates for their domains. The intermediate certificates are issued by the usual root CAs but have a "Certificate Signing" key usage attribute. However I've noticed in some cases that the intermediate certificate is simply granted to "Company Name" and there is no mention of anything related to a domain name. How is the company prevented from signing certificates for any domain name other than its own?
The certificate chain for Microsoft has no mention of domain name anywhere other than the last certificate in the chain.