rawCritical

Some production certificates have illegal boolean encoding, as in: correct tag, correct length, containing a single byte that is neither 0x00 nor 0xFF. X509CertificateExtension treats those as follows:

• 0x00 ->FALSE

• absent ->null

• anything else ->TRUE

Not calling out any names here, but if you can ship literal billions of smartphones, you should be able to comprehend DER encodings of booleans. You know who you are!

See also encoding flaws documented by Warden Supreme.