I've added a test case to test021 to verify proper behavior of modify/delete of the userCertificate;binary attribute. You can confirm this result by running test021 in HEAD or RE23. Modify/delete of userCertificate should be expected to fail and does. Kurt