diff --git a/include/ZeroTierOne.h b/include/ZeroTierOne.h
index 6abc04f20..b03abf866 100644
--- a/include/ZeroTierOne.h
+++ b/include/ZeroTierOne.h
@@ -565,7 +565,7 @@ typedef struct
 		/**
 		 * Packet characteristic flags being matched
 		 */
-		uint64_t characteristics;
+		uint64_t characteristics[2];
 
 		/**
 		 * IP port range -- start-end inclusive -- host byte order
diff --git a/node/CertificateOfMembership.hpp b/node/CertificateOfMembership.hpp
index 9f251f6b9..430ed7857 100644
--- a/node/CertificateOfMembership.hpp
+++ b/node/CertificateOfMembership.hpp
@@ -79,18 +79,6 @@ namespace ZeroTier {
 class CertificateOfMembership
 {
 public:
-	/**
-	 * Certificate type codes, used in serialization
-	 *
-	 * Only one so far, and only one hopefully there shall be for quite some
-	 * time.
-	 */
-	enum Type
-	{
-		// tuples of unsigned 64's signed with Ed25519
-		COM_UINT64_ED25519 = 1
-	};
-
 	/**
 	 * Reserved qualifier IDs
 	 *
@@ -245,21 +233,6 @@ public:
 	void setQualifier(uint64_t id,uint64_t value,uint64_t maxDelta);
 	inline void setQualifier(ReservedId id,uint64_t value,uint64_t maxDelta) { setQualifier((uint64_t)id,value,maxDelta); }
 
-	/**
-	 * Get the value of a qualifier field
-	 *
-	 * @param id Qualifier ID
-	 * @return Value or 0 if not found
-	 */
-	inline uint64_t getQualifierValue(uint64_t id)
-	{
-		for(unsigned int i=0;i<_qualifierCount;++i) {
-			if (_qualifiers[i].id == id)
-				return _qualifiers[i].value;
-		}
-		return 0;
-	}
-
 #ifdef ZT_SUPPORT_OLD_STYLE_NETCONF
 	/**
 	 * @return String-serialized representation of this certificate
@@ -322,7 +295,7 @@ public:
 	template<unsigned int C>
 	inline void serialize(Buffer<C> &b) const
 	{
-		b.append((unsigned char)COM_UINT64_ED25519);
+		b.append((uint8_t)1);
 		b.append((uint16_t)_qualifierCount);
 		for(unsigned int i=0;i<_qualifierCount;++i) {
 			b.append(_qualifiers[i].id);
@@ -342,8 +315,8 @@ public:
 		_qualifierCount = 0;
 		_signedBy.zero();
 
-		if (b[p++] != COM_UINT64_ED25519)
-			throw std::invalid_argument("invalid type");
+		if (b[p++] != 1)
+			throw std::invalid_argument("invalid field type");
 
 		unsigned int numq = b.template at<uint16_t>(p); p += sizeof(uint16_t);
 		uint64_t lastId = 0;
diff --git a/node/NetworkConfig.cpp b/node/NetworkConfig.cpp
index 3a307fe7f..7a7abdd6f 100644
--- a/node/NetworkConfig.cpp
+++ b/node/NetworkConfig.cpp
@@ -237,8 +237,9 @@ bool NetworkConfig::toDictionary(Dictionary<ZT_NETWORKCONFIG_DICT_CAPACITY> &d,b
 				tmp.append((uint16_t)rules[i].v.port[1]);
 				break;
 			case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-				tmp.append((uint8_t)8);
-				tmp.append((uint64_t)rules[i].v.characteristics);
+				tmp.append((uint8_t)16);
+				tmp.append((uint64_t)rules[i].v.characteristics[0]);
+				tmp.append((uint64_t)rules[i].v.characteristics[1]);
 				break;
 			case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
 				tmp.append((uint8_t)4);
@@ -455,7 +456,8 @@ bool NetworkConfig::fromDictionary(const Dictionary<ZT_NETWORKCONFIG_DICT_CAPACI
 							rules[ruleCount].v.port[1] = tmp.at<uint16_t>(p + 2);
 							break;
 						case ZT_NETWORK_RULE_MATCH_CHARACTERISTICS:
-							rules[ruleCount].v.characteristics = tmp.at<uint64_t>(p);
+							rules[ruleCount].v.characteristics[0] = tmp.at<uint64_t>(p);
+							rules[ruleCount].v.characteristics[1] = tmp.at<uint64_t>(p + 8);
 							break;
 						case ZT_NETWORK_RULE_MATCH_FRAME_SIZE_RANGE:
 							rules[ruleCount].v.frameSize[0] = tmp.at<uint16_t>(p);