{
        MatchingRule    *smr;
        Syntax          *syn;
+       Syntax          **compat_syn = NULL;
        int             code;
 
+       if( def->mrd_compat_syntaxes ) {
+               int i;
+               for( i=0; def->mrd_compat_syntaxes[i]; i++ ) {
+                       /* just count em */
+               }
+
+               compat_syn = ch_malloc( sizeof(Syntax *) * (i+1) );
+
+               for( i=0; def->mrd_compat_syntaxes[i]; i++ ) {
+                       compat_syn[i] = syn_find( def->mrd_compat_syntaxes[i] );
+                       if( compat_syn[i] == NULL ) {
+                               return SLAP_SCHERR_SYN_NOT_FOUND;
+                       }
+               }
+
+               compat_syn[i] = NULL;
+       }
+
        smr = (MatchingRule *) ch_calloc( 1, sizeof(MatchingRule) );
        AC_MEMCPY( &smr->smr_mrule, mr, sizeof(LDAPMatchingRule));
 
        smr->smr_bvoid.bv_val = smr->smr_mrule.mr_oid;
        smr->smr_oidlen = strlen( mr->mr_oid );
        smr->smr_usage = def->mrd_usage;
+       smr->smr_compat_syntaxes = compat_syn;
        smr->smr_convert = def->mrd_convert;
        smr->smr_normalize = def->mrd_normalize;
        smr->smr_match = def->mrd_match;
        int             code;
        const char      *err;
 
-       if( def->mrd_usage == SLAP_MR_NONE ) {
+       if( def->mrd_usage == SLAP_MR_NONE &&
+               def->mrd_compat_syntaxes == NULL )
+       {
 #ifdef NEW_LOGGING
                LDAP_LOG( OPERATION, ERR, 
                        "register_matching_rule: %s not usable\n", def->mrd_desc, 0, 0 );
 #ifdef NEW_LOGGING
                        LDAP_LOG( OPERATION, ERR,
                           "register_matching_rule: could not locate associated "
-                          "matching rule %s for %s\n",  def->mrd_associated, def->mrd_desc, 0 );
+                          "matching rule %s for %s\n",
+                               def->mrd_associated, def->mrd_desc, 0 );
 #else
                        Debug( LDAP_DEBUG_ANY, "register_matching_rule: could not locate "
                                "associated matching rule %s for %s\n",
                        return -1;
                }
 #endif
-
        }
 
-       mr = ldap_str2matchingrule( def->mrd_desc, &code, &err, LDAP_SCHEMA_ALLOW_ALL);
+       mr = ldap_str2matchingrule( def->mrd_desc, &code, &err,
+               LDAP_SCHEMA_ALLOW_ALL );
        if ( !mr ) {
 #ifdef NEW_LOGGING
                LDAP_LOG( OPERATION, ERR, 
                        "register_matching_rule: %s before %s in %s.\n",
                        ldap_scherr2str(code), err, def->mrd_desc );
 #else
-               Debug( LDAP_DEBUG_ANY, "Error in register_matching_rule: %s before %s in %s\n",
+               Debug( LDAP_DEBUG_ANY,
+                       "Error in register_matching_rule: %s before %s in %s\n",
                    ldap_scherr2str(code), err, def->mrd_desc );
 #endif
 
                        "register_matching_rule: %s for %s in %s.\n",
                        scherr2str(code), err, def->mrd_desc );
 #else
-               Debug( LDAP_DEBUG_ANY, "Error in register_matching_rule: %s for %s in %s\n",
+               Debug( LDAP_DEBUG_ANY,
+                       "Error in register_matching_rule: %s for %s in %s\n",
                    scherr2str(code), err, def->mrd_desc );
 #endif
 
                 * Framework doesn't support this (yet).
                 */
 
-               if (!( mr->smr_usage & SLAP_MR_EXT )) {
+               if (!( ( mr->smr_usage & SLAP_MR_EXT )
+                       || mr->smr_compat_syntaxes ) )
+               {
                        continue;
                }
 
 
                at = NULL;
                for ( at_start( &at ); at; at_next( &at ) ) {
-                       if( mr->smr_syntax == at->sat_syntax ||
+                       if( mr->smr_usage & SLAP_MR_EXT && ( 
+                               mr->smr_syntax == at->sat_syntax ||
                                mr == at->sat_equality ||
-                               mr == at->sat_approx )
+                               mr == at->sat_approx ) )
                        {
                                ldap_charray_add( &applies_oids, at->sat_cname.bv_val );
+
+                       } else if ( mr->smr_compat_syntaxes ) {
+                               int i;
+                               for( i=0; mr->smr_compat_syntaxes[i]; i++ ) {
+                                       if( at->sat_syntax == mr->smr_compat_syntaxes[i] ) {
+                                               ldap_charray_add( &applies_oids, at->sat_cname.bv_val );
+                                               break;
+                                       }
+                               }
                        }
                }
 
                        mru->smru_applies_oids = applies_oids;
 #ifdef NEW_LOGGING
                        {
-                               char    *str = ldap_matchingruleuse2str( &mru->smru_mruleuse );
+                               char *str = ldap_matchingruleuse2str( &mru->smru_mruleuse );
                                LDAP_LOG( OPERATION, INFO, "matchingRuleUse: %s\n", str, 0, 0 );
                                ldap_memfree( str );
                        }
 #else
                        {
-                               char    *str = ldap_matchingruleuse2str( &mru->smru_mruleuse );
+                               char *str = ldap_matchingruleuse2str( &mru->smru_mruleuse );
                                Debug( LDAP_DEBUG_TRACE, "matchingRuleUse: %s\n", str, 0, 0 );
                                ldap_memfree( str );
                        }
 
        {NULL, 0, NULL, NULL, NULL}
 };
 
+#ifdef HAVE_TLS
+char *certificateExactMatchSyntaxes[] = {
+       "1.3.6.1.4.1.1466.115.121.1.8", NULL };
+#endif
+
 /*
  * Other matching rules in X.520 that we do not use (yet):
  *
         */
        {"( " directoryStringApproxMatchOID " NAME 'directoryStringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT, NULL,
                NULL, NULL,
                directoryStringApproxMatch,
                directoryStringApproxIndexer, 
 
        {"( " IA5StringApproxMatchOID " NAME 'IA5StringApproxMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT,
+               SLAP_MR_HIDE | SLAP_MR_EQUALITY_APPROX | SLAP_MR_EXT, NULL,
                NULL, NULL,
                IA5StringApproxMatch,
                IA5StringApproxIndexer, 
        
        {"( 2.5.13.0 NAME 'objectIdentifierMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                objectIdentifierMatch, caseIgnoreIA5Indexer, caseIgnoreIA5Filter,
                NULL},
 
        {"( 2.5.13.1 NAME 'distinguishedNameMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                dnMatch, dnIndexer, dnFilter,
                NULL},
 
        {"( 2.5.13.2 NAME 'caseIgnoreMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD, NULL,
                NULL, NULL,
                caseIgnoreMatch, caseExactIgnoreIndexer, caseExactIgnoreFilter,
                directoryStringApproxMatchOID },
 
        {"( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_ORDERING,
+               SLAP_MR_ORDERING, NULL,
                NULL, NULL,
                caseIgnoreOrderingMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseExactIgnoreSubstringsMatch,
                caseExactIgnoreSubstringsIndexer,
 
        {"( 2.5.13.5 NAME 'caseExactMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                caseExactMatch, caseExactIgnoreIndexer, caseExactIgnoreFilter,
                directoryStringApproxMatchOID },
 
        {"( 2.5.13.6 NAME 'caseExactOrderingMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )",
-               SLAP_MR_ORDERING,
+               SLAP_MR_ORDERING, NULL,
                NULL, NULL,
                caseExactOrderingMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.7 NAME 'caseExactSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseExactIgnoreSubstringsMatch,
                caseExactIgnoreSubstringsIndexer,
 
        {"( 2.5.13.8 NAME 'numericStringMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD, NULL,
                NULL, NULL,
                caseIgnoreIA5Match,
                caseIgnoreIA5Indexer,
 
        {"( 2.5.13.10 NAME 'numericStringSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseIgnoreIA5SubstringsMatch,
                caseIgnoreIA5SubstringsIndexer,
 
        {"( 2.5.13.11 NAME 'caseIgnoreListMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD, NULL,
                NULL, NULL,
                caseIgnoreListMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.12 NAME 'caseIgnoreListSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseIgnoreListSubstringsMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.13 NAME 'booleanMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                booleanMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.14 NAME 'integerMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                integerMatch, integerIndexer, integerFilter,
                NULL},
 
        {"( 2.5.13.15 NAME 'integerOrderingMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
-               SLAP_MR_ORDERING,
+               SLAP_MR_ORDERING, NULL,
                NULL, NULL,
                integerOrderingMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.16 NAME 'bitStringMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                bitStringMatch, bitStringIndexer, bitStringFilter,
                NULL},
 
        {"( 2.5.13.17 NAME 'octetStringMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                octetStringMatch, octetStringIndexer, octetStringFilter,
                NULL},
 
        {"( 2.5.13.20 NAME 'telephoneNumberMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD, NULL,
                NULL, NULL,
                telephoneNumberMatch,
                telephoneNumberIndexer,
 
        {"( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                telephoneNumberSubstringsMatch,
                telephoneNumberSubstringsIndexer,
 
        {"( 2.5.13.22 NAME 'presentationAddressMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                NULL, NULL, NULL,
                NULL},
 
        {"( 2.5.13.23 NAME 'uniqueMemberMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                uniqueMemberMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.24 NAME 'protocolInformationMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                protocolInformationMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.27 NAME 'generalizedTimeMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                generalizedTimeMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )",
-               SLAP_MR_ORDERING,
+               SLAP_MR_ORDERING, NULL,
                NULL, NULL,
                generalizedTimeOrderingMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.29 NAME 'integerFirstComponentMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                integerFirstComponentMatch, NULL, NULL,
                NULL},
 
        {"( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                objectIdentifierFirstComponentMatch, NULL, NULL,
                NULL},
 #ifdef HAVE_TLS
        {"( 2.5.13.34 NAME 'certificateExactMatch' "
                "SYNTAX 1.2.826.0.1.3344810.7.1 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, certificateExactMatchSyntaxes,
                certificateExactConvert, NULL,
                certificateExactMatch,
                certificateExactIndexer, certificateExactFilter,
 
        {"( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT, NULL,
                NULL, NULL,
                caseExactIA5Match, caseExactIA5Indexer, caseExactIA5Filter,
                IA5StringApproxMatchOID },
 
        {"( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD,
+               SLAP_MR_EQUALITY | SLAP_MR_EXT | SLAP_MR_DN_FOLD, NULL,
                NULL, NULL,
                caseIgnoreIA5Match, caseIgnoreIA5Indexer, caseIgnoreIA5Filter,
                IA5StringApproxMatchOID },
 
        {"( 1.3.6.1.4.1.1466.109.114.3 NAME 'caseIgnoreIA5SubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseIgnoreIA5SubstringsMatch,
                caseIgnoreIA5SubstringsIndexer,
 
        {"( 1.3.6.1.4.1.4203.1.2.1 NAME 'caseExactIA5SubstringsMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )",
-               SLAP_MR_SUBSTR,
+               SLAP_MR_SUBSTR, NULL,
                NULL, NULL,
                caseExactIA5SubstringsMatch,
                caseExactIA5SubstringsIndexer,
        /* needs updating */
        {"( 1.3.6.1.4.1.4203.666.4.1 NAME 'authPasswordMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )",
-               SLAP_MR_EQUALITY,
+               SLAP_MR_EQUALITY, NULL,
                NULL, NULL,
                authPasswordMatch, NULL, NULL,
                NULL},
 #ifdef SLAPD_ACI_ENABLED
        {"( 1.3.6.1.4.1.4203.666.4.2 NAME 'OpenLDAPaciMatch' "
                "SYNTAX 1.3.6.1.4.1.4203.666.2.1 )",
-               SLAP_MR_EQUALITY,
+               SLAP_MR_EQUALITY, NULL,
                NULL, NULL,
                OpenLDAPaciMatch, NULL, NULL,
                NULL},
 
        {"( 1.2.840.113556.1.4.803 NAME 'integerBitAndMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
-               SLAP_MR_EXT,
+               SLAP_MR_EXT, NULL,
                NULL, NULL,
                integerBitAndMatch, NULL, NULL,
                NULL},
 
        {"( 1.2.840.113556.1.4.804 NAME 'integerBitOrMatch' "
                "SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )",
-               SLAP_MR_EXT,
+               SLAP_MR_EXT, NULL,
                NULL, NULL,
                integerBitOrMatch, NULL, NULL,
                NULL},
 
-       {NULL, SLAP_MR_NONE, NULL, NULL, NULL, NULL}
+       {NULL, SLAP_MR_NONE, NULL,
+               NULL, NULL, NULL, NULL, NULL,
+               NULL }
 };
 
 int
        }
 
        for ( i=0; mrule_defs[i].mrd_desc != NULL; i++ ) {
-               if( mrule_defs[i].mrd_usage == SLAP_MR_NONE ) {
+               if( mrule_defs[i].mrd_usage == SLAP_MR_NONE &&
+                       mrule_defs[i].mrd_compat_syntaxes == NULL )
+               {
                        fprintf( stderr,
                                "slap_schema_init: Ingoring unusable matching rule %s\n",
                                 mrule_defs[i].mrd_desc );