west sends a cert that has a combined serverAuth, clientAuth EKU profile