- routers propertly wait on certs that are about to expire - routers no longer send multiple extension requests - routers now request cert verification - routers now verify new certs before saving - controller now supports verification requests