Don't raise an UnsupportedExtension for critical extensions. (#3550)

* Don't raise an UnsupportedExtension for critical extensions.

Fixes #2903
Fixes #2901
Fixes #3325

* Don't link

* Revert "Don't link"

This reverts commit 4fe847f91d9dd45cdc28a4984c4e44aad62a5de6.

* fix

* Revert "Revert "Don't link""

This reverts commit 856031b5a1fbad04ac218fa94ebf37dcd402f3ed.

* fix

* Deprecate this

* Better changelog entry

4 files changed, 17 insertions, 17 deletions

diff --git a/src/cryptography/hazmat/backends/openssl/decode_asn1.py b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
index b6910d9c..19df4c8c 100644
--- a/src/cryptography/hazmat/backends/openssl/decode_asn1.py
+++ b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
@@ -215,20 +215,14 @@ class _X509ExtensionParser(object):
             try:
                 handler = self.handlers[oid]
             except KeyError:
-                if critical:
-                    raise x509.UnsupportedExtension(
-                        "Critical extension {0} is not currently supported"
-                        .format(oid), oid
-                    )
-                else:
-                    # Dump the DER payload into an UnrecognizedExtension object
-                    data = backend._lib.X509_EXTENSION_get_data(ext)
-                    backend.openssl_assert(data != backend._ffi.NULL)
-                    der = backend._ffi.buffer(data.data, data.length)[:]
-                    unrecognized = x509.UnrecognizedExtension(oid, der)
-                    extensions.append(
-                        x509.Extension(oid, critical, unrecognized)
-                    )
+                # Dump the DER payload into an UnrecognizedExtension object
+                data = backend._lib.X509_EXTENSION_get_data(ext)
+                backend.openssl_assert(data != backend._ffi.NULL)
+                der = backend._ffi.buffer(data.data, data.length)[:]
+                unrecognized = x509.UnrecognizedExtension(oid, der)
+                extensions.append(
+                    x509.Extension(oid, critical, unrecognized)
+                )
             else:
                 ext_data = backend._lib.X509V3_EXT_d2i(ext)
                 if ext_data == backend._ffi.NULL:
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
index bec56d5b..16c05003 100644
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -15,6 +15,7 @@ import warnings
 # ubiquity of their use. They should not be removed until we agree on when that
 # cycle ends.
 PersistentlyDeprecated = DeprecationWarning
+DeprecatedIn19 = PendingDeprecationWarning
 
 
 def read_only_property(name):
diff --git a/src/cryptography/x509/__init__.py b/src/cryptography/x509/__init__.py
index 38ae0f07..c5465fbb 100644
--- a/src/cryptography/x509/__init__.py
+++ b/src/cryptography/x509/__init__.py
@@ -4,6 +4,7 @@
 
 from __future__ import absolute_import, division, print_function
 
+from cryptography import utils
 from cryptography.x509 import certificate_transparency
 from cryptography.x509.base import (
     Certificate, CertificateBuilder, CertificateRevocationList,
@@ -109,6 +110,12 @@ OID_INVALIDITY_DATE = CRLEntryExtensionOID.INVALIDITY_DATE
 OID_CA_ISSUERS = AuthorityInformationAccessOID.CA_ISSUERS
 OID_OCSP = AuthorityInformationAccessOID.OCSP
 
+UnsupportedExtension = utils.deprecated(
+    UnsupportedExtension,
+    __name__,
+    "UnsupportedExtension is no longer necessary, it is never raised",
+    utils.DeprecatedIn19
+)
 
 __all__ = [
     "certificate_transparency",
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
index ba19b3a3..aa30f8ff 100644
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -52,9 +52,7 @@ class DuplicateExtension(Exception):
 
 
 class UnsupportedExtension(Exception):
-    def __init__(self, msg, oid):
-        super(UnsupportedExtension, self).__init__(msg)
-        self.oid = oid
+    pass
 
 
 class ExtensionNotFound(Exception):