I need an SSL certificate with a few extra uncommon EKUs (i.e. 18.104.22.168.22.214.171.124.2, "IPSec Intermediate System Usage"). Self-signed certificate is not an option. Does anybody know about any CAs that allow additional EKUs? I contacted Namecheap, Comodo and Godaddy, and all of them replied that they cannot issue one.
The Baseline Requirements from the CA/Browser Forum are rather strict about inceluding extendedKeyUsage values in a certificate which are non-standard. While it is not completely forbidden, the wording is such, that a CA will usually want to avoid the hassle (see section 126.96.36.199).
Some Root Stores (Microsoft) even require of CAs to explicitely state all possible EKU values in advance, that a root or intermediate certificate might sign.