NotBefore:    now.Add(-time.Hour),
				NotAfter:     now.Add(time.Hour),
				ExtKeyUsage:  []ExtKeyUsage{ExtKeyUsageServerAuth},
			},
			eku:         []ExtKeyUsage{ExtKeyUsageEmailProtection},
			expectedErr: "x509: certificate specifies an incompatible key usage",
		},
		{
			name: "non-nested KU",
			cert: &Certificate{
				SerialNumber: big.NewInt(1),

			{
				{},
			},
		},
		leaf: leafSpec{
			sans: []string{"dns:example.com"},
			ekus: []string{"email"},
		},
		requestedEKUs: []ExtKeyUsage{ExtKeyUsageClientAuth, ExtKeyUsageEmailProtection},
	},

	// #81: EKUs that are not asserted in VerifyOpts are not required to be
	// nested.
	{
		roots: make([]constraintsSpec, 1),
		intermediates: [][]constraintsSpec{
			{
				{

// Each of the ExtKeyUsage* constants define a unique action.
type ExtKeyUsage int

const (
	ExtKeyUsageAny ExtKeyUsage = iota
	ExtKeyUsageServerAuth
	ExtKeyUsageClientAuth
	ExtKeyUsageCodeSigning
	ExtKeyUsageEmailProtection
	ExtKeyUsageIPSECEndSystem
	ExtKeyUsageIPSECTunnel
	ExtKeyUsageIPSECUser
	ExtKeyUsageTimeStamping
	ExtKeyUsageOCSPSigning
	ExtKeyUsageMicrosoftServerGatedCrypto
	ExtKeyUsageNetscapeServerGatedCrypto

		name:          "EKULeafValid",
		leaf:          smimeLeaf,
		intermediates: []string{smimeIntermediate},
		roots:         []string{smimeRoot},
		currentTime:   1594673418,
		keyUsages:     []ExtKeyUsage{ExtKeyUsageEmailProtection},

		expectedChains: [][]string{
			{"CORPORATIVO FICTICIO ACTIVO", "EAEko Herri Administrazioen CA - CA AAPP Vascas (2)", "IZENPE S.A."},
		},
	},
	{

		{"Expired", Const, 0},
		{"ExtKeyUsage", Type, 0},
		{"ExtKeyUsageAny", Const, 0},
		{"ExtKeyUsageClientAuth", Const, 0},
		{"ExtKeyUsageCodeSigning", Const, 0},
		{"ExtKeyUsageEmailProtection", Const, 0},
		{"ExtKeyUsageIPSECEndSystem", Const, 1},
		{"ExtKeyUsageIPSECTunnel", Const, 1},
		{"ExtKeyUsageIPSECUser", Const, 1},
		{"ExtKeyUsageMicrosoftCommercialCodeSigning", Const, 10},