GnuTLS: Fix certextract expansion