<p>Can anyone please tell me if Certifying Authorities (CAs) are allowed to make modifications to the Certificate Signing Request (CSR) before actually signing the certificate with their own private key? </p>

<p>Specifically, I'd like to know if it's valid for the CA to insert additional fields (such as EKUs) into the cert before adding their signature.</p>

I can't speak about CAs in general, but I once ran a Windows Server 2003 network with its own CA, and it's definitely possible to make
```
certreq
```
(through the
```
-attrib
```
option) add additional fields to the CSR before it gets to the CA. Thus, it looks to me like it's possible for the CA itself to do much the same thing.
Your mileage may vary.