Tidy up CRL handling by checking for critical extensions when it is