Andre, There is an inaccuracy in the contexts described by the strawman. The context type 'X509' describes proxy certificates. These are not standard X509 certificates, therefore this type should be renamed GSI. Graeme