Hi Nico, > But mainly the appeal of this approach is that the pieces needed all exist. Are you talking of http://www.citi.umich.edu/projects/kerb_pki/ as your kx509 implementation? It appears to be based on Kerberos4… -Rick