1. 3280bis David Cooper

2. Changes Since Draft 02 ● Section 1 (Introduction): Replaced text highlighting changes between RFC 2459 and 3280 with text highlighting changes between RFC 3280 and 3280bis. ● Sections 4.1.2.4 and 4.1.2.6 (issuer and subject): Added text about using TeletexString, BMPString, and UniversalString in names of new CAs and end entities that are joining an existing domain where those encodings are already in use  Alignment with draft-ietf-pkix-cert-utf8-03.txt

3. Changes Since Draft 02 ● Section 4.2.1.12 (Extended Key Usage): Clarified that an application that requires the presence of an EKU extension with a particular OID is not required to accept the presence of anyExtendedKeyUsage as a match. ● Section 6.2 (Using the Path Validation Algorithm): Removed paragraph about extending path validation algorithm to conform to PEM rules.

4. Changes Since Draft 02 ● Added to Security Considerations text about  risks involving different strings with similar visual representations  risk of circular dependencies when using an HTTPS URI in cRLDistributionsPoints, authorityInfoAccess, or subjectInfoAccess extensions. ● Section 7 (Rules for Processing Internationalized Names): Clarified that strings are prepared as “stored” prior to comparison. ● Updated references section.

5. Open Issues ● Should 3280bis forbid conforming CAs from imposing name constraints on the x400Address, ediPartyName, and registeredID name forms? ● Include guidance on handling/avoiding circular dependencies in certificate status checking? ● Escape clause?