$ openssl x509 -in DigiCertHighAssuranceEVRootCA.pem -out DigiCertHighAssuranceEVRootCA_rejectServerAuth.pem -addreject serverAuth
$ openssl s_client -connect pypi.python.org:443 -CAfile DigiCertHighAssuranceEVRootCA_rejectServerAuth.pem -verify_return_error
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert High Assurance EV Root CA
verify error:num=28:certificate rejected
---
Certificate chain
 0 s:/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=3359300/street=16 Allen Rd/postalCode=03894-4801/C=US/ST=NH/L=Wolfeboro,/O=Python Software Foundation/CN=www.python.org
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
 1 s:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
   i:/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA
---
...
subject=/businessCategory=Private Organization/jurisdictionC=US/jurisdictionST=Delaware/serialNumber=3359300/street=16 Allen Rd/postalCode=03894-4801/C=US/ST=NH/L=Wolfeboro,/O=Python Software Foundation/CN=www.python.org
issuer=/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Extended Validation Server CA
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 4016 bytes and written 327 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 159CFA42F2590AF5CC29FDEFB7903E7C1A39C805A660A455EF1C0043A06C13C9
    Session-ID-ctx:
    Master-Key: ADBC704BFC0D01A33CAA75CD66BD3787DFFCAE9F02ACCDE2577DB761460A836972B91D6D8202081A18CA41E05FE7EF01
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 1200 (seconds)
    TLS session ticket:
    0000 - 63 cc 77 4a 00 db 2c 42-2e 8f 76 23 dd a9 ae 53   c.wJ..,B..v#...S
    0010 - c2 3a 77 60 e4 cd c6 d5-ca d0 85 e3 ed 7b 1d 60   .:w`.........{.`
    0020 - 54 e2 32 a8 e8 02 e2 71-19 58 bd 7f 13 52 49 56   T.2....q.X...RIV
    0030 - 80 35 52 47 33 0b e1 64-1d f8 17 cc d7 4b b8 fd   .5RG3..d.....K..
    0040 - b3 41 ec ef 30 fc b2 e7-e5 c3 1d 28 62 dd 42 69   .A..0......(b.Bi
    0050 - a2 ce 47 3e c2 b4 64 c1-a4 23 5f a0 85 0f 1a cb   ..G>..d..#_.....
    0060 - de 76 cd ec c0 7f ec 09-df f9 07 b0 6d bc 82 0b   .v..........m...
    0070 - 9c 48 63 52 81 b2 f7 28-ed c7 56 d6 51 09 22 78   .HcR...(..V.Q."x
    0080 - ed e4 71 ca e0 6b a7 e6-85 51 55 11 8a d9 c2 df   ..q..k...QU.....
    0090 - cd 7d cd b8 b0 1c b4 aa-e6 30 50 6f 6c 3d cd 32   .}.......0Pol=.2

    Start Time: 1453288811
    Timeout   : 300 (sec)
    Verify return code: 28 (certificate rejected)
---
^C