Error on validating CSR with "critical" in subjectAlternativeName

Generate a CSR that marks the extension as critical:

```
openssl req -new -sha256 -key domain.key -subj "/" \
-reqexts SAN -config <(cat /etc/ssl/openssl.cnf \
<(printf "[SAN]\nsubjectAltName=critical,DNS:foo.com,DNS:www.foo.com"))
```

When pressing "Validate CSR", the following error appears:

```
Error: Failed validating CSR
```

Please, see https://www.openssl.org/docs/manmaster/apps/x509v3_config.html

Start by reproducing the failure with the provided OpenSSL CSR command, then trace the Validate CSR entry point to identify where a critical subjectAlternativeName is rejected. Done means the supplied CSR validates successfully and existing CSR validation behavior remains intact.

索引モデルが issue の本文から書いたものです。