I'm aware that sites like StartSSL use Client-Certificates, I opened mine in Firefox and it showed me: "SSL-Client-Certificate", "E-Mail-Receiver-Certificate", "E-Mail-Signer-Certificate".
Now I'm asking myself, for self-signed certificates, is it possible to restrict usage of X.509(v3?) certificates to be only TLS-Client? (-> no server / no S/MIME)