[EXTERNAL] Re: Heimdahl Kerberos on MacOSX 10.9.5 using pkinit produces verify error

[Greg Hudson]

On 08/25/2015 12:50 AM, Glenn Machin wrote:
> Looks like it is an openssl issue, apparently fixed in version 1.0.1f
> .   Seems I asked a similar question then and found this on the
> krb5-bugs list -
> http://mailman.mit.edu/pipermail/krb5-bugs/2011-January/008510.html

Thanks for finding this; I remembered that too, but couldn't find the
details.

After I sent my last response, I was able to produce the "wrong tag"
error with your packet by disabling the use of CMS functions and forcing
the use of PKCS7 functions instead.  But it doesn't quite match the
"nested asn1 error" you are seeing, so I'm not sure it's the same thing.