x509 failure handling

[hramrach]

Hello,

I have a server from which I cannot boot using iPXE due to x509 failure.

Building with DEBUG=x509 I get certificate dump on the VGA console of which I see only the final lines which is not immensely helpful.

After some discussion on irc the probable cause was identified as one of the intermediate certificated in the chain setting 'Certificate Name Constraints' as critical extension.