PKINIT client has no configured identity; giving up?

[Nick]

I'm testing out PKINIT and encountered this error in the subject line.
Does anyone know what it's related to and/or how to debug and resolve
it further?

So far, PKINIT talks to the KDC, receives an MIT cookie and loads the
identity files: client0.pem and clientkey0.pem being invoked by 'kinit
-X X509_user_identity=FILE:/client0.pem,/clientkey0.pem".  I'm still
being requested to provide a password, which I understand should not
be required with PKINIT.

I'm using v1.20.2.0.

Thanks!