XKU_SSL_SERVER
x->ex_xkusage |= XKU_SSL_SERVER;
if (xku_reject(x, XKU_SSL_SERVER | XKU_SGC))
if ((x->ex_xkusage & (XKU_ANYEKU | XKU_SSL_SERVER)) != 0)