I need an SSL certificate with a few extra uncommon EKUs (i.e., "IPSec Intermediate System Usage"). Self-signed certificate is not an option. Does anybody know about any CAs that allow additional EKUs? I contacted Namecheap, Comodo and Godaddy, and all of them replied that they cannot issue one.

  • 1
    Why is self signed not an option? Is an enterprise CA een option? – hertitu Feb 15 '17 at 20:31
  • I don't want users to be forced to install my root certificate. Thus, I'd prefer to have a certificate signed by a recognized CA. – Roman Dmitrienko Feb 16 '17 at 6:42

The Baseline Requirements from the CA/Browser Forum are rather strict about inceluding extendedKeyUsage values in a certificate which are non-standard. While it is not completely forbidden, the wording is such, that a CA will usually want to avoid the hassle (see section

Some Root Stores (Microsoft) even require of CAs to explicitely state all possible EKU values in advance, that a root or intermediate certificate might sign.

  • Thanks for pointing out the requirements! Well, that apparently means that what I was intending to do is all but impossible. – Roman Dmitrienko Jun 20 '17 at 11:16
  • 1
    Probably. And even if you really find a CA, it would probably be VERY expensive. – mat Jun 20 '17 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.