I need an SSL certificate with a few extra uncommon EKUs (i.e. 1.3.6.1.5.5.8.2.2, "IPSec Intermediate System Usage"). Self-signed certificate is not an option. Does anybody know about any CAs that allow additional EKUs? I contacted Namecheap, Comodo and Godaddy, and all of them replied that they cannot issue one.
SnapOverflow
The Baseline Requirements from the CA/Browser Forum are rather strict about inceluding extendedKeyUsage values in a certificate which are non-standard. While it is not completely forbidden, the wording is such, that a CA will usually want to avoid the hassle (see section 7.1.2.4).
Some Root Stores (Microsoft) even require of CAs to explicitely state all possible EKU values in advance, that a root or intermediate certificate might sign.