Let's Encrypt: Gen Y Cross-Certified Subordinate CAs Missing ServerAuth EKU

Ah, so this was the "compliance" outage that caused them to stop issuing certs.