Re: PKINIT - allowed principal format?

[joda@pdc.kth.se (Johan Danielsson)]

"STEWARD, Curtis (Jamestown)" <Curtis.Steward@trw.com> writes:

> I'm new to Heimdal, it's the only opensource Kerberos
> implementation utilizing PKINIT that I know of, thanks.

I'm sure there are patches for MIT Kerberos too, but I don't know
where they hide it. The Czech patches are a start, but they need a lot
of work.

> Activity looks limited though, what is the status, alternatives, and
> expected update on PKINIT?

PKINIT itself is still in development, but I think it's getting closer
to a last call.

> I've tried laters versions of Heimdal with no luck, so I
> assume no version later than 4e (as doc'd :) ) will work 

There are some minor changes needed for it to work (as in compile, I
haven't tested it) with 0.5.

>    root = /usr/local/ca/testkeys/cacert.pem

I'm under the impression that the right side of this should be a x500
name.

I suppose Daniel can give more details.

/Johan