_nsCertType_ is an old Netscape-specific extension, which was used by the Netscape browser at a time when that browser was still alive. You can forget it nowadays.

The signing CA, by principle, acts in any way as it sees fit. It can put whatever it wishes in your certificate. Your certificate request is just a _suggestion_. You can more or less count on the CA to take the public key from your request and use that public key in the certificate; for everything less (including name, key usages and other extensions) this is completely up to the CA to decide. Microsoft's _Certificate Services_ uses "certificate templates" for its configuration, and the templates decide what goes in the certificates. According to my own tests, the key usage and extended key usages which you put in the certificate will be completely ignored.

What extensions are needed for client authentication, and/or for server authentication, depends on the involved software. You will find some information in my past prose, e.g. [this][1], [this][2] and [that][3].



  [1]: http://security.stackexchange.com/questions/26647/extensions-for-ssl-server-certificate/26650#26650
  [2]: http://security.stackexchange.com/questions/23036/what-are-the-netscape-cert-type-attributes-why-when-are-they-needed/23037#23037
  [3]: http://security.stackexchange.com/questions/24106/which-key-usages-are-required-by-each-key-exchange-method/24107#24107