[dxbjavid]

The TLSFeature extension is decoded as a sequence of integers, each of which is looked up in the mapping to the TLSFeatureType enum. That lookup goes through a dictionary access that raises a bare KeyError when the value isn't one of the two defined features, so a certificate whose TLSFeature extension carries an unrecognised value makes accessing extensions raise KeyError instead of the ValueError that every other malformed-extension path raises. That is awkward for anyone wrapping certificate parsing in except ValueError, since the KeyError escapes unhandled. I came across it while feeding crafted extension values through the parser. Mapping the missed lookup to a parse error makes it surface as a ValueError with the usual message, which also matches how an unrecognised name attribute tag is already handled. I kept the change inside parse_cert_ext so nothing else shifts, and added a regression test that builds a certificate carrying an unknown feature value.

[alex]

I'm not sure this change is worth the churn.

[dxbjavid]

fair on the churn. the only thing that nudged me to send it is that this is the one malformed-extension path that escapes as a KeyError rather than a ValueError, so a cert with an unknown TLSFeature value slips past anyone guarding parsing with except ValueError. it's a narrow edge though, so if you'd rather not carry it i'm happy to close it.