Does consul supports chained SAN certificates?

Does the consul supports chained SAN certificates? We are repeatedly getting the following errors
~~~
consul[xxx]: consul.rpc: failed to read byte: tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage: leaf contains the following, recognized EKUs: 1.3.6.1.5.5.7.3.1 from=xxxx:xxx
consul[xxxx]: consul: error getting server health from "xxxxxhost-namexxx": rpc error getting client: failed to get conn: remote error: tls: bad certificate
~~~

The log:
~~~
consul[xxx]: consul.rpc: failed to read byte: tls: failed to verify client's certificate: x509: certificate specifies an incompatible key usage: leaf contains the following, recognized EKUs: 1.3.6.1.5.5.7.3.1 from=xxxxx:xxx
~~~
Is not occurring anymore but "tls: bad certificate" still persists.

Start by reviewing Consul's TLS certificate handling against the reported x509 key-usage error; the issue names no source file or test. Determine whether chained SAN certificates are supported and explain the remaining "tls: bad certificate" error, documenting a reproducible conclusion or required change.

Written by the indexing model from the issue text.