The pattern of unpacking cert/crl extensions seems to be pretty common across the PRs related to this one; can we extract a method to handle this so we don't have to repeat the unpacking logic?