diff --git a/core/Certificate.cpp b/core/Certificate.cpp
index 12286c11c..9e64f417b 100644
--- a/core/Certificate.cpp
+++ b/core/Certificate.cpp
@@ -185,6 +185,14 @@ void Certificate::addSubjectUpdateUrl(const char *url)
 	this->subject.updateUrlCount = (unsigned int)m_updateUrls.size();
 }
 
+void Certificate::setExtendedAttributes(const Dictionary &x)
+{
+	m_extendedAttributes.clear();
+	x.encode(m_extendedAttributes);
+	this->extendedAttributes = m_extendedAttributes.data();
+	this->extendedAttributesSize = (unsigned int)m_extendedAttributes.size();
+}
+
 Vector< uint8_t > Certificate::encode(const bool omitSignature) const
 {
 	Vector< uint8_t > enc;
diff --git a/core/Certificate.hpp b/core/Certificate.hpp
index 2fc71de80..a77c58a8c 100644
--- a/core/Certificate.hpp
+++ b/core/Certificate.hpp
@@ -48,16 +48,12 @@ namespace ZeroTier {
 class Certificate : public ZT_Certificate
 {
 	friend class SharedPtr< Certificate >;
-
 	friend class SharedPtr< const Certificate >;
 
 public:
 	Certificate() noexcept;
-
 	Certificate(const ZT_Certificate &apiCert);
-
 	Certificate(const Certificate &cert);
-
 	~Certificate();
 
 	Certificate &operator=(const ZT_Certificate &cert);
@@ -116,13 +112,7 @@ public:
 	 *
 	 * @param x Extended attributes (set by issuer)
 	 */
-	ZT_INLINE void setExtendedAttributes(const Dictionary &x)
-	{
-		m_extendedAttributes.clear();
-		x.encode(m_extendedAttributes);
-		this->extendedAttributes = m_extendedAttributes.data();
-		this->extendedAttributesSize = (unsigned int)m_extendedAttributes.size();
-	}
+	void setExtendedAttributes(const Dictionary &x);
 
 	/**
 	 * Marshal this certificate in binary form
diff --git a/core/Tests.cpp b/core/Tests.cpp
index c59ad8bce..4b79541e6 100644
--- a/core/Tests.cpp
+++ b/core/Tests.cpp
@@ -1161,9 +1161,14 @@ extern "C" const char *ZTT_crypto()
 				return "Verify decoded certificate";
 			}
 			ZT_T_PRINTF("OK" ZT_EOL_S);
-
-			cert.zero();
-			cert2.zero();
+			
+			ZT_T_PRINTF("  Test certificate copy/construct... ");
+			SharedPtr<Certificate> cert3(new Certificate(*cert2));
+			if (!ZTT_deepCompareCertificates(*cert2, *cert3)) {
+				ZT_T_PRINTF("FAILED (compare copy with original)" ZT_EOL_S);
+				return "Certificate copy";
+			}
+			ZT_T_PRINTF("OK" ZT_EOL_S);
 		}
 	} catch (std::exception &e) {
 		ZT_T_PRINTF(ZT_EOL_S "[crypto] Unexpected exception: %s" ZT_EOL_S, e.what());