(userCertificate;binary=*) works (userCertificate=*) doesn't but should Needs to be expanded to include equality tests.