Cannot use critical constraints in the server certificate.

Environment

• ejabberd version: 21.01-2
• Erlang version: Erlang (SMP,ASYNC_THREADS) (BEAM) emulator version 11.1.8
• OS: Linux (Debian 11)
• Installed from: distro package

Errors from error.log/crash.log

No errors

Bug description

Please, give us a precise description (what does not work, what is expected, etc.)

Attempting to use a certificate chain as a server certificate with a critical flag on the X509v3 Basic Constraints causes ejabberd to reject the chain with the following error in ejabberd.log:

[warning] <0.355.0>@ejabberd_pkix:log_warnings/1:393
 Invalid certificate in /etc/ejabberd/ejabberd.pem: at line 43:
 unknown_critical_extension

The only critical constraints in this certificate chain are:

X509v3 Basic Constraints: critical
                CA:FALSE
X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0

and

X509v3 Basic Constraints: critical
                CA:TRUE

I cannot change these constraints as they are defined by the CA.
I would expect that the most basic of CA flag checks would be handled correctly by whatever TLS library is used.

Start with the certificate validation warning from ejabberd_pkix:log_warnings/1 and reproduce it using the chain at /etc/ejabberd/ejabberd.pem. Check how the Erlang TLS or certificate-validation path handles critical X509v3 Basic Constraints. Done means a chain containing critical CA:FALSE, CA:TRUE, and pathlen:0 constraints is accepted when otherwise valid, without the unknown_critical_extension warning.