HX509_QUERY_MATCH_EKU
q->match &= ~HX509_QUERY_MATCH_EKU;
q->match |= HX509_QUERY_MATCH_EKU;
if ((q->match & HX509_QUERY_MATCH_EKU) &&