Add extension length validation to CA