Right now it doesn’t appear to be possible to include an ext-comp-def tag inside of additional-sfrs. This is causing an issue in VPN Client because it defines FCS_CKM_EXT.2 as an extended component. As a temporary workaround, the ext-comp-def tag can be moved to right before a non-extended SFR, but this causes a display issue in the VPN Client module because this causes the ECD to be out of order (FCS_IPSEC_EXT.1 should come after it but it’s not possible to put FCS_CKM_EXT.2 before that because the schema doesn’t allow two consecutive _ext-comp-def_s if they are not separated by an f-component, and ext-comp-def cannot be the last thing inside of a subsection).
Right now it doesn’t appear to be possible to include an ext-comp-def tag inside of additional-sfrs. This is causing an issue in VPN Client because it defines FCS_CKM_EXT.2 as an extended component. As a temporary workaround, the ext-comp-def tag can be moved to right before a non-extended SFR, but this causes a display issue in the VPN Client module because this causes the ECD to be out of order (FCS_IPSEC_EXT.1 should come after it but it’s not possible to put FCS_CKM_EXT.2 before that because the schema doesn’t allow two consecutive _ext-comp-def_s if they are not separated by an f-component, and ext-comp-def cannot be the last thing inside of a subsection).