likewise a certificate issuer can only sign with one key type in this scenario only one algorithm can be supported if support is desired for a second algorithm a distinct certificate hierarchy would be required maintaining a second hierarchy would be very expensive further if the current x 509 public key and signature elements were to be changed from a single item to a multiple item format the new certificates would be incompatible with the old ones all extensions in an x 509 certificate are included in the portion of the x 509 certificate referred to as u201c data to be signed u201d elements in the u201c data to be signed u201d portion are not encrypted thus they may be obtained for validation and are protected from modification by the signature referring now to fig3 an outline 70 of an extended x 509 certificate according to the present invention is illustrated the present invention provides two new x 509 extensions 72 74 the first extension 72 lists the alternate algorithms with the associated public key being certified for that algorithm the second extension 74 lists alternative signatures for algorithms supported by the issuing certificate authority when validating the primary or existing signature in a signed x 509 certificate the certificate is signed over the entire unsigned certificate including all extensions when validating the signature of an alternate signature the signature is validated for the unsigned certificate except for the extension containing the list of signatures this allows the important information to be authenticated with any of the signatures and allows backward compatibility with entities which understand single algorithm certificates only as long as the primary.