Reject certificates with unhandled critical extensions.