The DN syntax allows NUL (U+00000) to occur without any escaping. Most APIs, and hence most applications, cannot handle this. I suspect most servers cannot handle them as well. I suggest adding NUL to the set of characters which must be escaped. Kurt