code: def _determine_critical(self, name):
          
  
          if name == 'subject_alt_name':
              return len(self._subject) == 0
  
          if name == 'basic_constraints':
              return self.ca is True
  
          return {
              'subject_directory_attributes': False,
              'key_usage': True,
              'issuer_alt_name': False,
              'name_constraints': True,
              # Based on example EV certificates, non-CA certs have this marked
              # as non-critical, most likely because existing browsers don't
              # seem to support policies or name constraints
              'certificate_policies': False,
              'policy_mappings': True,
              'policy_constraints': True,
              'extended_key_usage': False,
              'inhibit_any_policy': True,
              'subject_information_access': False,
              'tls_feature': False,
              'ocsp_no_check': False,
          }.get(name, False)
docs: :return:
              A boolean indicating the correct value of the critical flag for
              an extension, based on information from RFC5280 and RFC 6960. The
              correct value is based on the terminology SHOULD or MUST.