use a STACK for certificate extensions