Insert missing UPN into certificate?

Thank you. That is good to know that a certificate can't be modified without breaking the signatures.

But maybe there is another way? Let's say you use the smartcard without the preffered attributes just to start an APN session by mapping the login with another attribute on the certificate. Then query AD for the user account. Then somehow make a new temporary certificate (bake it within f5) to present to the server that now holds the preffered attributes. Maybe ,probably better to reissue the smartcards (thousands..)