extract

Get a role from a certificate.

Return

the role if the extension is present, or null otherwise.

Throws

if the extension is present but is invalid.