Tom, all: Perhaps the following design principle is well understood but in the context of this thread I think it bears repeating. Namely, the more authorization type attributes bound into a PK cert, the more likely that PK cert will be revoked prior to its expiration. Hence ACs. Mike