X.509 certificate token capabilities