As I understand the creation of a x509 certificate is a simple 3 step process:
- The client generates a private and a public key.
- The clients generates a certificate signing request for the pair and signs it using its private key.
- The certificate authority verifies the certificate signing request and generates a signature.
I am somewhat confused as to what information is provided by the client and what end up being imposed by the certificate authority. I'm fine with the client providing the basic information about who he is, but I do not understand why it is up to the client to provide v3 extensions (i.e. extendedKeyUsage). To me, the client is some user interested in using the PKI for accesses some sort of service. Thus the PKI is responsible for determining the scope of the certificate. Analogous its not the worker's job to make sure not to access restricted resources, its the security departments job to keep him from doing so.
In short: Why does the client provide v3 extensions in the certificate signing request instead of the certificate authority imposing them when generating the certificate?