This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/5205

cert-request decodes CSRs and examines the request extensions.  It
currently only permits the following extensions to appear:

- Subject Key Identifier
- Basic Constraints
- Key Usage
- Extended Key Usage
- Subject Alternative Name

I also have a patch on review that allows the IECUserRoles extension
to appear.

I propose removing these checks.

Rationale:

- No extension is copied from the CSR or otherwise included in the
 final certificate unless using a Dogtag profile that is explicitly
 configured to do so.  The mere presence of a request extension
 does not, on its own, affect the final certificate.

- With the current checks, adding a profile to copy a certain
 esoteric / custom extension from CSR to cert will be ineffective
 unless cert-request knows about it.  This renders custom profiles
 useless for working with such unknown extensions, unless / until
 we add support for them.

- I am not aware of any reason why we should whitelist request
 extensions.  If there are reasons, please enlighten me!

Objection:

- If no error is thrown then the user will naturally expect that the
 extensions requested were added to the cert and then spent a lot of
 time trying to figure out how their CSR is wrong. Reject a cert you
 cannot issue is doing the user a favor.

Counterpoint:

- CAs simply ignore extensions you added if they don't like issuing them.
 There is no commenting of whether you are denied or not.
 
 We can add support of comparing request and resulted cert, if needed,
 but I don't think we should really do a favor in pre-check.

We must make difficult things easier, but not at the expense of
making other difficult things possible.  At the moment, despite
custom profiles, it is not possible to use custom profiles to work
with extensions other than those listed above, without patching
FreeIPA.