My understanding is that this needs to be changed to add an extension instead of clobbering all extensions. Does https://github.com/jrussek/puppet/blob/f2198d84a943d7d0d9a0c584af624a7220439aa0/lib/puppet/ssl/certificate_revocation_list.rb#L92 need to be changed as well?