@Override
        public boolean isForwardCheckingSupported() {
            return true;
        }
If an EKU extension is present in the end-entity certificate,
it MUST contain an appropriate key usage. For servers, this
includes anyExtendedKeyUsage, serverAuth, or the historical
Server Gated Cryptography options of nsSGC or msSGC.  For
clients, this includes anyExtendedKeyUsage and clientAuth.
common/src/main/java/org/conscrypt/TrustManagerImpl.java