X.509 – Can and can’t do Can do Search for specific OIDs and attributes such as Certificate policies, EKUs Search for complete extensions, such as acceptable key usage extensions Can’t do Search for an extension with specific partial content when length of extension is unknown Search for X somewhere in part Y' |