diff --git a/Data/X509/Validation.hs b/Data/X509/Validation.hs
--- a/Data/X509/Validation.hs
+++ b/Data/X509/Validation.hs
@@ -44,6 +44,7 @@
     | NameMismatch String      -- ^ connection name and certificate do not match
     | InvalidWildcard          -- ^ invalid wildcard in certificate
     | LeafKeyUsageNotAllowed   -- ^ the requested key usage is not compatible with the leaf certificate's key usage
+    | LeafKeyPurposeNotAllowed -- ^ the requested key purpose is not compatible with the leaf certificate's extended key usage
     | LeafNotV3                -- ^ Only authorized an X509.V3 certificate as leaf certificate.
     | EmptyChain               -- ^ empty chain of certificate
     deriving (Show,Eq)
@@ -76,8 +77,16 @@
     , checkLeafV3         :: Bool
     -- | Check that the leaf certificate is authorized to be used for certain usage.
     -- If set to empty list no check are performed, otherwise all the flags is the list
-    -- need to exists in the key usage extension
+    -- need to exists in the key usage extension. If the extension is not present,
+    -- the check will pass and behave as if the certificate key is not restricted to
+    -- any specific usage.
     , checkLeafKeyUsage   :: [ExtKeyUsageFlag]
+    -- | Check that the leaf certificate is authorized to be used for certain purpose.
+    -- If set to empty list no check are performed, otherwise all the flags is the list
+    -- need to exists in the extended key usage extension if present. If the extension is not
+    -- present, then the check will pass and behave as if the certificate is not restricted
+    -- to any specific purpose.
+    , checkLeafKeyPurpose :: [ExtKeyUsagePurpose]
     -- | Check the top certificate names matching the fully qualified hostname (FQHN).
     -- it's not recommended to turn this check off, if no other name checks are performed.
     , checkFQHN           :: Maybe String
@@ -100,7 +109,8 @@
     , checkCAConstraints  = True
     , checkExhaustive     = False
     , checkLeafV3         = True
-    , checkLeafKeyUsage   = [KeyUsage_keyEncipherment]
+    , checkLeafKeyUsage   = []
+    , checkLeafKeyPurpose = []
     , checkFQHN           = fqhn
     }
 
@@ -177,12 +187,22 @@
             | otherwise = return []
 
         doKeyUsageCheck cert = return $
-            case (certVersion cert, checkLeafKeyUsage checks) of
-                (2, usage) -> if intersect usage flags == usage then [] else [LeafKeyUsageNotAllowed]
-                _          -> []
-          where flags = case extensionGet $ certExtensions cert of
-                            Just (ExtKeyUsage keyflags) -> keyflags
-                            Nothing                     -> []
+               compareListIfExistAndNotNull mflags (checkLeafKeyUsage checks) LeafKeyUsageNotAllowed
+            ++ compareListIfExistAndNotNull mpurposes (checkLeafKeyPurpose checks) LeafKeyPurposeNotAllowed
+          where mflags = case extensionGet $ certExtensions cert of
+                            Just (ExtKeyUsage keyflags) -> Just keyflags
+                            Nothing                     -> Nothing
+                mpurposes = case extensionGet $ certExtensions cert of
+                            Just (ExtExtendedKeyUsage keyPurposes) -> Just keyPurposes
+                            Nothing                                -> Nothing
+                -- compare a list of things to an expected list. the expected list
+                -- need to be a subset of the list (if not Nothing), and is not will
+                -- return [err]
+                compareListIfExistAndNotNull Nothing     _        _   = []
+                compareListIfExistAndNotNull (Just list) expected err
+                    | null expected                       = []
+                    | intersect expected list == expected = []
+                    | otherwise                           = [err]
 
         doCheckCertificate cert =
             exhaustiveList (checkExhaustive checks)
diff --git a/x509-validation.cabal b/x509-validation.cabal
--- a/x509-validation.cabal
+++ b/x509-validation.cabal
@@ -1,5 +1,5 @@
 Name:                x509-validation
-Version:             1.4.6
+Version:             1.4.7
 Description:         X.509 Certificate and CRL validation
 License:             BSD3
 License-file:        LICENSE
@@ -25,7 +25,7 @@
                    , pem >= 0.1 && < 0.3
                    , asn1-types >= 0.2 && < 0.3
                    , asn1-encoding >= 0.8 && < 0.9
-                   , x509 >= 1.4.2 && < 1.5
+                   , x509 >= 1.4.7 && < 1.5
                    , x509-store >= 1.4 && < 1.5
                    , crypto-pubkey >= 0.1.4 && < 0.3
                    , crypto-pubkey-types >= 0.4 && < 0.5