This module is EXPERIMENTAL.

Are you sure you need this extension? Because OpenSSL doesn’t seem to pay it much regard: man 5 x509v3_config doesn’t mention it, and I can’t find any certificates that use it. Also, despite the fact that this module, as best I can tell, implements the extension as it’s consistently described everywhere I’ve found, OpenSSL doesn’t render this module’s output cleanly. (i.e., when using the -text flag of openssl x509). Maybe there’s a mistake in this module’s ASN.1 logic? It’s not complicated, so I’m not sure what would be wrong.

In the absence of a parser against which to test this module’s output, I’m a bit perplexed. Please drop me a line if you can shed light on the situation.