I've committed to cvs the extracted corrections that make service certificates look like they behave correctly according to the debug output. I do not believe this fixes them in general, but I'll try to test in a bit. --Ivan