We wrote this up for the IPA team awhile back, and I think it will help out the PKI team as well: https://fedorahosted.org/freeipa/wiki/PatchFormat Note that the part at the bottom about Thunderbird is still relevant.