BouncyCastle create a certificate request with extensions

This example demonstrates how to generate a pkcs10 request that includes a key usage extension.

IList extOids = new ArrayList() { X509Extensions.KeyUsage };
IList extItems = new ArrayList() { new X509Extension(DerBoolean.True, new DerOctetString(new KeyUsage(KeyUsage.NonRepudiation))) };

DerSet attributes = new DerSet(
       new AttributePkcs(PkcsObjectIdentifiers.Pkcs9AtExtensionRequest, new DerSet(
       new X509Extensions(
              extOids,
              extItems
       )))
);

...

pkcs10 = new Pkcs10CertificationRequestDelaySigned("SHA256WITHRSA", new X509Name(subjectDN), pubKey, attributes);