// example, an element of DNSNames may not be a valid DNS domain name.)
	DNSNames       []string
	EmailAddresses []string
	IPAddresses    []net.IP
	URIs           []*url.URL

	// Name constraints
	PermittedDNSDomainsCritical bool // if true then the name constraints are marked critical.
	PermittedDNSDomains         []string
	ExcludedDNSDomains          []string
	PermittedIPRanges           []*net.IPNet

		return false, err
	}
	if out.ExcludedDNSDomains, out.ExcludedIPRanges, out.ExcludedEmailAddresses, out.ExcludedURIDomains, err = getValues(excluded); err != nil {
		return false, err
	}
	out.PermittedDNSDomainsCritical = e.Critical

	return unhandled, nil
}

func processExtensions(out *Certificate) error {
	var err error
	for _, e := range out.Extensions {
		unhandled := false

		{"Certificate.NotAfter", Field, 0},
		{"Certificate.NotBefore", Field, 0},
		{"Certificate.OCSPServer", Field, 2},
		{"Certificate.PermittedDNSDomains", Field, 0},
		{"Certificate.PermittedDNSDomainsCritical", Field, 0},
		{"Certificate.PermittedEmailAddresses", Field, 10},
		{"Certificate.PermittedIPRanges", Field, 10},
		{"Certificate.PermittedURIDomains", Field, 10},
		{"Certificate.Policies", Field, 22},

pkg crypto/x509, type Certificate struct, NotBefore time.Time
pkg crypto/x509, type Certificate struct, PermittedDNSDomains []string
pkg crypto/x509, type Certificate struct, PermittedDNSDomainsCritical bool
pkg crypto/x509, type Certificate struct, PolicyIdentifiers []asn1.ObjectIdentifier
pkg crypto/x509, type Certificate struct, PublicKey interface{}