>As I read your suggestion, you want to add an element to the DN >that directs the user to the appropriate directory. The new >element is syntactically an RDN, but semantically is something >different. The resulting new-style DN appears to me to >semantically comparable to an LDAP URL.
I don't think the proposed "dir" attribute is semantically very different from any other naming attributes. What we're trying to do with names in certificates is to maintain the X.500 illusion that a DN uniquely identifies an entry in some global directory. But we don't have a single global directory; instead we have a collection of directories which don't talk to one another - i.e. instead of the single DN root assumed by X.500, we actually have multiple roots, one for each directory.