What is the Extended Key Usage Extension?
The Extended Key Usage Extension (EKU) is much like the Key Usage Extension (KUE), except that EKU values are defined in terms of “purpose” (for example, signing OCSP responses, identifying an SSL client, and so on.), and are easily extensible.  EKU is defined with object identifiers called OIDs.  If the EKU extension is omitted, all operations are potentially valid.

What’s the difference between KUE and EKU?
The EKU is newer and tends to be considered “the” usage-restriction mechanism, while KUE is usually considered less flexible. KUE is defined in terms of “operations.” EKU is defined in terms of “purpose.” EKUs are usually checked offensively (i.e. “must have this EKU OID”), while KUEs are usually checked defensively (i.e. “needs to have non-repudiation bit and may have encrypt/decrypt-only bit”). For a Certificate Authority, the list of purposes limits what kinds of certificates the authority can create; an operation must be included in both the authority and the certificates it signs to be valid.

What does “This extension is critical” mean?
This is also known as the “criticality indicator.” It is a flag that instructs software that uses the certificate whether it is safe to ignore the Extended Key Usage Extension if it does not recognize it. A certificate will be rejected if the software does not recognize a “critical extension.”