(Reporter wasn't able to provide a certificate chain that uses this
feature for testing.)

Fixes #6831

R=golang-dev, bradfitz, r
CC=golang-dev
https://golang.org/cl/40340043