title: Unhandled critical extension
body: <p>We are trying to create a node.js application which should interact with a server over HTTPS (>TLS v1.2). We are given some list of key, cert files to establish a connection with the server. Node HTTPS requires CA, cert, key files which are CA file, client certificate, and key files. When provided these we are getting the following error:</p>
  
  <pre class="lang-none prettyprint-override"><code>Error: unhandled critical extension.
  </code></pre>
  
  <p>After spending some time on the internet, we found that the Server cert that was received at the time of TLS handshake has some custom extensions. Later when we did <code>openssl verify -CAfile ca_file.pem client_cert.pem</code> we could reproduce it:</p>
  
  <pre class="lang-none prettyprint-override"><code>error 34 at 0 depth lookup:unhandled critical extension
  OK
  </code></pre>
  
  <p>So, this seems something to do with OpenSSL. How do we make OpenSSL understand our custom extensions? Those custom extensions are critical as well, so that we cannot just ignore the error by setting <code>-ignore_critical</code>.</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>CA certificate has the following in its <code>X509v3 extensions</code> section,</p>
  
  <pre><code>X509v3 extensions:
    X509v3 Subject Key Identifier: 
        A1:*:*:*...
    X509v3 Authority Key Identifier: 
        keyid:1D:*:*:*
  
    X509v3 Basic Constraints: critical
        CA:TRUE, pathlen:0
    X509v3 Key Usage: 
        Digital Signature, Certificate Sign, CRL Sign
  </code></pre>
  
  <p>Server certificate has the following in its <code>X509v3 extensions</code> section,</p>
  
  <pre><code>X509v3 extensions:
    X509v3 Basic Constraints: 
        CA:FALSE
    Netscape Cert Type: 
        SSL Client
    X509v3 Key Usage: 
        Digital Signature, Non Repudiation, Key Encipherment
    X509v3 Subject Key Identifier: 
        E1:*:*...
    X509v3 Authority Key Identifier: 
        keyid:F9:*:*:*...
  
    X509v3 Extended Key Usage: 
        TLS Web Client Authentication
            1.3.*.*.*...: critical
              02.
              TYPE:TEST..FCC_ID:12345..DP_ID:54321
            1.3.*.*.*...: critical
        ..NULL:TRUE
  </code></pre>
  
  <p>The CA certificate don't have the <code>X509v3 Extended Key Usage</code> section.</p>