def get_extensions(cert_type):
    '''
    Fetch X509 and CSR extension definitions from tls:extensions:
    (common|server|client) or set them to standard defaults.

    .. versionadded:: 2015.8.0

    cert_type:
        The type of certificate such as ``server`` or ``client``.

    CLI Example:

    .. code-block:: bash

        salt '*' tls.get_extensions client

    '''

    assert X509_EXT_ENABLED, ('X509 extensions are not supported in '
                              'pyOpenSSL prior to version 0.15.1. Your '
                              'version: {0}'.format(OpenSSL_version))

    ext = {}
    if cert_type == '':
        log.error('cert_type set to empty in tls_ca.get_extensions(); '
                  'defaulting to ``server``')
        cert_type = 'server'

    try:
        ext['common'] = __salt__['pillar.get']('tls.extensions:common', False)
    except NameError as err:
        log.debug(err)

    if not ext['common'] or ext['common'] == '':
        ext['common'] = {
            'csr': {
                'basicConstraints': 'CA:FALSE',
            },
            'cert': {
                'authorityKeyIdentifier': 'keyid,issuer:always',
                'subjectKeyIdentifier': 'hash',
            },
        }

    try:
        ext['server'] = __salt__['pillar.get']('tls.extensions:server', False)
    except NameError as err:
        log.debug(err)

    if not ext['server'] or ext['server'] == '':
        ext['server'] = {
            'csr': {
                'extendedKeyUsage': 'serverAuth',
                'keyUsage': 'digitalSignature, keyEncipherment',
            },
            'cert': {},
        }

    try:
        ext['client'] = __salt__['pillar.get']('tls.extensions:client', False)
    except NameError as err:
        log.debug(err)

    if not ext['client'] or ext['client'] == '':
        ext['client'] = {
            'csr': {
                'extendedKeyUsage': 'clientAuth',
                'keyUsage': 'nonRepudiation, digitalSignature, keyEncipherment',
            },
            'cert': {},
        }

    # possible user-defined profile or a typo
    if cert_type not in ext:
        try:
            ext[cert_type] = __salt__['pillar.get'](
                'tls.extensions:{0}'.format(cert_type))
        except NameError as e:
            log.debug(
                'pillar, tls:extensions:%s not available or '
                'not operating in a salt context\n%s', cert_type, e
            )

    retval = ext['common']

    for Use in retval:
        retval[Use].update(ext[cert_type][Use])

    return retval