Per RFc 6112 use SignedData not ContentInfo for anonymous when the KDC offers support for PKINIT_KX padata. https://github.com/krb5/krb5/commit/f79ba7eca6846552fcd00d42f4b8f67e05af2e40 Commit By: hartmans Revision: 25186 Changed Files: U trunk/src/plugins/preauth/pkinit/pkinit.h U trunk/src/plugins/preauth/pkinit/pkinit_clnt.c U trunk/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c