Re: Ca certificate

[Love Hörnquist Åstrand <lha@kth.se>]

Hello Alberto,

>    i have another question about pkinit. In the configuration file  
> we must specify a ca certificate for the client and for the server,  
> because the first must verify the public key of the second and the  
> second the public key of the first.
>
> Is it correct?

Yes, written out in examples:

The section for trust anchor that the client to verify the KDC  
certificate is the following:

[appdefaults]
	pkinit_anchors = FILE:/path/to/trust-anchors.pem

the section for the trust anchor that the KDC uses to verify the  
client certifiate is the following:

[kdc]
	pkinit_anchors = FILE:/path/to/trust-anchors.pem

Love