The node you are looking for is at gnutls_x509_name_constraints_check.