- support multiple issuer certificates - support separate responder keys and certificates - support openssl index.txt format certificate databases