Problem when i use pkinit

[=?gb2312?B?1cXB1Q==?=]

Hi,
   I use krb-1.6.3 to implement my pkinit according to the admin.pdf, 
I add X.509 cert to the directory, and I can get my TGT use 'kinit', but if I move my certs from the very directory, I can also get TGT, which puzzled me several days. Can you explain why ? 
   My question is  whether the preauthentication process of kerberos has been taken or not?
   My cert&key file format are both *.pem, rather than *.crt & *.key, and have assigned { +requires_preauth } in  kdc.conf. Is there anything wrong i made.
   Thanks,
--------------------------------------------Lin Zhang, Peking University, Beijing, China
_________________________________________________________________
Windows Live Photo gallery ÊýÂëÏà»úµÄ³¬¼¶°é£¬ÇáËɹÜÀíºÍ±à¼­ÕÕƬ£¬»¹ÄÜÖÆ×÷È«¾°ÃÀͼ£¡
http://get.live.cn/product/photo.html