Hi all, These patches implement support for copying the ExtendedKeyUsage extension from a signing request to the certificate, addressing https://fedorahosted.org/freeipa/ticket/2915. My email from a few days ago goes into a bit more detail and puts forward the question of whether this is even a reasonable approach to solving #2915. Since I haven't yet received any feedback I figured I'd go ahead and publish the patches. Patch 0002: Add appropriate ExtendedKeyUsage constraints to all profiles that support this extension. To check that none were missed: $ ag -l extendedKeyUsageExtDefaultImpl \ | xargs ag -L extendedKeyUsageExtConstraintImpl Patch 0003: The actual fix: EKU extension is copied from signing request, or the default is used when the extension does not appear in the request.