Logging something to stderr was not helpful, and it's best to be
on the safe side anyways.
Whitelist a single null byte following the SAN extension. This
is a harmless and common error.
As of now, all certificates in the CT logs parse successfully.
All certificates are now parsed with a special, extremely
lax parser that extracts only the DNS names. Only if the
DNS names match the domains we're interested in will we attempt
to parse the cert with the real X509 parser. This ensures that
we won't miss a very badly encoded certificate that has been
issued for a monitored domain.
As of the time of commit, the lax parser is able to process every
logged certificate in the known logs.
Andrew Ayer