The GenExtKeyUsage tool creates a base-64 encoded blob that adds ExtendedKeyUsage (OID 2.5.29.37) to the certificate. This blob is pasted into the certificate approval page when the certificate is created.