code: public void setExtendedKeyUsage(Set<String> keyPurposeSet) throws IOException {
          if ((keyPurposeSet == null) || keyPurposeSet.isEmpty()) {
              this.keyPurposeSet = null;
              keyPurposeOIDSet = null;
          } else {
              this.keyPurposeSet =
                  Collections.unmodifiableSet(new HashSet<String>(keyPurposeSet));
              keyPurposeOIDSet = new HashSet<ObjectIdentifier>();
              for (String s : this.keyPurposeSet) {
                  keyPurposeOIDSet.add(new ObjectIdentifier(s));
              }
          }
      }
docs: Sets the extendedKeyUsage criterion. The {@code X509Certificate}
  must allow the specified key purposes in its extended key usage
  extension. If {@code keyPurposeSet} is empty or {@code null},
  no extendedKeyUsage check will be done. Note that an
  {@code X509Certificate} that has no extendedKeyUsage extension
  implicitly allows all key purposes.
  <p>
  Note that the {@code Set} is cloned to protect against
  subsequent modifications.
  
  @param keyPurposeSet a {@code Set} of key purpose OIDs in string
  format (or {@code null}). Each OID is represented by a set of
  nonnegative integers separated by periods.
  @throws IOException if the OID is invalid, such as
  the first component being not 0, 1 or 2 or the second component
  being greater than 39.
  @see #getExtendedKeyUsage