Add EKU to CSR using Keytool?

Question

How can I add the "Server Authentication" EKU to a CSR or private key using Keytool?

Here is what i'm doing:

1. Generate key-pair with ">Keytool -genseckey -dname="CN="my.server.com" ...
2. Generate CSR using the key-pair created in step #1.
3. Submitting the CSR to a Windows Enterprise CA, asking for a Web Server cert.

The CA rejects the CSR with "The certificate is not valid for the requested usage.". How can I add the "requested usage" using keytool so that the CA will issue the cert?

Answer 1

You can do this only with the JDK7 or later version of keytool. OpenJDK 7 should have this version.