Suggested enhancement
There's no way to set additional attributes in CSR, only extensions.
I need to generate CSR with challenge password (PKCS#9 OID 1.2.840.113549.1.9.7).
Right now I have custom serialization to DER to add that attribute, but all fields of mbedtls_x509write_csr are private in 3.0.
Justification
I need it for certificate enrollment/renewal using SCEP