Proxy cert extensions MUST be critical