The term "user certificate" is used in X.509 (and X.511) without being defined. I assume that a user certificate is a public-key certificate issued to an end-user. There is an attribute type called userCertificate, which has the syntax of public-key certificates. It seems therefore clear that a user certificate cannot be an attribute certificate. In the "8.6.2.7 AA Issuing Distribution Point extension" the term user certificate is mentioned in last the paragraph just before the three notes. Is that correct? The term "user certificate" should be defined. Any comments? Erik Andersen Andersen's L-Service Elsevej 48, DK-3500 Vaerloese Denmark Mobile: +45 2097 1490 email: era@xxxxxxx www.x500.eu www.x500standard.com