As I noted in https://github.com/puppetlabs/puppet/pull/2237#discussion_r8913612 it seems like there's a common pattern for unpacking cert/crl extensions, can this behavior be extracted to a method?