Conformance The following change (or similar) appears for numerous extensions: This extension MUST NOT be marked critical. Conforming CAs MUST mark this extension non-critical. Appears where 3280 is more restrictive than X.509 Necessary to indicate that certificates issued under less restrictive profiles need not be rejected |