I guess I'm convinced by Carl that it would be best to require that a certificate have exactly ONE subject and exactly ONE auth field. However, I think it is extremely important that the user interface allow the user to see a list of names for ease-of-use reasons... Ron Rivest