This is described as puppetCertAttributes above.  Same question for ppRegCertExt and ppPrivCertExt -- they are described as registeredAttributes and privateAttributes above.

A related point, I think we could use a line explaining what this syntax is, or a pointer back into the specs regarding where it comes from.