No extension is strictly necessary in the SSL server certificate, but some extensions can only help:
Authority Key Identifier extension will help clients link the certificate with the issuing CA.
CRL Distribution Points extension (non critical) should be used to point to the URL where the CRL should be found.
Authority Information Access extension can be used to include a pointer (URL) to the certificate for the issuing CA itself; the same extension can point to an OCSP responder, if applicable.
- If a
Key Usage extension is used, it should include some flags:
keyEncipherment for RSA keys to use with TLS_RSA_* cipher suites,
digitalSignature for RSA and DSA keys to use with the TLS_DHE_* cipher suites (there is some confusion about whether
keyEncipherment should be used in the case of RSA-based key exchange, so it is safest to include both flags).
- If you have a formally defined certificate policy, have a pointer to it (OID + download URL) included in all certificates in the path, or at least the SSL server certificate itself: it will give you some legal protection, should disputes arise.
Subject Alt Name extension should be used to indicate the SSL server name. In the absence of such an extension, all browsers will fallback to the CN component of the subjectDN, but this extension is still nominally "preferred" (see RFC 2818 for details).
Of course, all these extensions are supposed to be enforced by the issuing CA, so if you already have the CA, there should be no extra question here.
If in doubt, consult the Internet X.509 PKI Profile. The profile defines what you should morally follow. If you fully conform to it, your certificates will work everywhere. Browsers are actually much more lenient than that.