On 21/01/16 23:04, Peter Bowen wrote: > Based on concerns raised offlist about some cert profiles used for > identity cards, I'll the following alternative: <snip> Looks OK to me... Gerv