This document well describes the recommended profiles for both CA and EE certificates, which is very useful for both 
Grid CAs and relying parties.  My only concern is section 2.4.1 which describes that basicConstraints extension must be 
critical in CA certificates.  I understand that RFC3280 describes basicConstraints must appear as a critical extension 
in all CA certificates that contain public keys used to validate digital signatures on certificates, but in practical, 
there are may commercial CAs which do not comply with this requirement not to limit available clinet applications.