 This is in contrast with the Directory model which associates the attribute caCertificate with a listed certificate authority.Thus the browser can verify the SSL cert of the website by means of the loaded group of accepted certificates or the root certificates can be looked up in an X.500 or LDAP Directory (or via HTTP/S) and imported into the list of trusted Certificate Authorities.The "bound" distinguished name is located in the subject fields of the certificate which matches the Directory entry.