For our internal tests I need to set up the mutual SSL authentication between our IIS server (it hosts two applications: ASP.NET web GUI and a web service) and clients (accessing the server in two possible ways: web GUI with a browser and web service with a client created with WinForms). When tests are finished and results are evaluated, I will have to give some pointers to our customer how to set it up and configure on their environment – a closed, corporate environment, reachable by non-public URLs via VPN.

I am quite familiar with PKI, keys and certificates in general, I just do not have much experience with PKI in context of HTTPS. With some available tools, mostly XCA, I managed to create my root CA certificate, server certificate and a bunch of client certificates; I installed them in IIS and in client stores, and things work quite smoothly, but there are some issues and questions:

• What are (extended) key usage values required for a server certificate? In my test cert, I got Digital Signature, Non Repudiation, Key Encipherment and extended TLS Web Server Authentication – am I missing any? Are all of these required?
• The same question about client certificates: what key usages are required? My test certificates have Digital Signature, Key Encipherment, Data Encipherment and extended TLS Web Client Authentication – am I missing any? Are all of these required?
• Are there any other special features that a client certificate should have?
• Server certificate should have its name listed in a list of SANs as a DNS entry (or IP, if accessed by IP address, right?). But what about Subject's CN field of its Distinguished Name? should it have any specific form? Should be empty? Can non-public addresses, like, for example, mytestenv.mycompany.lan be used as a SAN? Currently in my test server cert I have only a Subject CN set, and no SAN DNS entry, and I believe I need to add it, am I right?
• Are there any steps (other than adding CA cert to trusted CAs in browser or Windows store) I need to take to prevent browsers from displaying full-page security warning about site not being secure? I think I can live without 'green lock' or with some warning in an address bar or something, but for example Chrome displays full page security error and does not show the web page until I configure a security exception for the server. How can I prevent that? May missing SAN be the cause? IE and Firefox display the page.
• Do things like DV/OV/EV, Certificate Transparency, "HTTPS apocalypse" incoming for browsers, or maybe something else, affect my (and possibly customer's) setup in any way? Do I need to take a particular care of these?

If possible, I would be interested in both general remarks, and in requirements of specific servers (especially IIS) and browsers (in customer's infrastructure these are going to be mostly IE 11+ and Edge).