“…If the certificate is present, the subject name in the certificate MUST exactly match the X.500 distinguished name provided in the taName field, the public key MUST exactly match the public key in the pubKey field, and the subjectKeyIdentifier extension, if present, MUST exactly match the key identifier in the keyId field. The complete description of the syntax and semantics of the Certificate are provided in [RFC5280] inhibitPolicyMapping indicates if policy mapping is allowed in the certification path. When set to TRUE, policy mapping is not permitted.…”