Is it possible for the CA to intervene and add extensions to an X.509 that aren't in the CSR? For example, a company runs an internal CA, and it augments certificates with additional extensions (required for operation, therefore critical). It's a lot smoother to do this directly than expect the client to add them to the CSR themselves. The latter would probably require a tool that presents a form and then injects the extensions, rather than being able to allow the client to just invoke OpenSSL from the command-line.

This is being posted to SO because I'm an engineer doing security-related work, and am seeking the insights of those doing similar work.