krb5/krb5 — pull request #20 by nalind (2013-05-10 19:45:09+00:00)
Title: Fixes for PKINIT when built with NSS

A mixture of fixes for pkinit_crypto_nss.c and workarounds for bugs and limitations of NSS's PEM module. With these applied, and using client and KDC certificates which also include the TLS client and server extended key usages, t_anonpkinit and t_authpkinit succeed on a Fedora 19 system, and debug messages no longer complain about errors attempting to shut down their NSS context.