Add cert_extension option