Skip Menu |

Subject: SVN Commit

Handle PKINIT DH replies with no certs

If a PKINIT Diffie-Hellman reply contains no certificates in the
SignedData object, that may be because the signer certificate was a
trust anchor as transmitted to the KDC. Heimdal's KDC, for instance,
filters client trust anchors out of the returned set of certificates.
Match against idctx->trustedCAs and idctx->intermediateCAs to handle
this case. This fix only works with OpenSSL 1.0 or later; when built
against OpenSSL 0.9.x, the client will still require a cert in the

Code changes suggested by

(cherry picked from commit db83abc7dcfe369bd4467c78eebb7028ba0c0e0d)
Author: Greg Hudson <>
Committer: Tom Yu <>
Commit: 9bbf3649867f444674716941b787f6699885c803
Branch: krb5-1.10
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)