This is in response to Basically, there are two issues. 1. We want to use the selected CA to generate the SSL server cert. In the code though, for a clone, the code that sets the relevant preop parameter used to determine the right CA to go to - is only run after we issue the sslserver cert request. That means it always goes to the security domain CA. This code is now reversed. 2. Due to a DS bug (which has been fixed), the attributes on the pkiSubsystem entry in the clone CA security domain database we in lower case, rather than the existing case. Thats actually ok from an ldap point of view. We create some XML from those attributes -- just in case, we should make the XML matches in this case case insensitive. Please review. Thanks, Ade