private Optional<Extensions> getExtensions() {
        return Optional.of(csr.getAttributes(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest))
                .filter(attributes -> attributes.length > 0)
                .map(attributes -> attributes[0])
                .map(attribute -> Extensions.getInstance(attribute.getAttrValues().getObjectAt(0)));
    }
@return If basic constraints extension is present: returns true if CA cert, false otherwise. Returns empty if the extension is not present.
security-utils/src/main/java/com/yahoo/security/Pkcs10Csr.java