I think that the set of standard extensions not implemented by openssl is so small as to not be worrying about; I think we should just drop the exception handling and specifically handle standard extensions how you suggested.