allow additional attributes in primary cert