For anonymous, MIT 1.9 sends ContentInfo rather than SignedData. This violates RFc 6112. This patch accepts the RFC 6112 style encoding. https://github.com/krb5/krb5/commit/54ac55310fcad408e9cfeee2891f8c7bfbc47044 Commit By: hartmans Revision: 25184 Changed Files: U trunk/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c U trunk/src/plugins/preauth/pkinit/pkinit_srv.c