Hi Nico, > But mainly the appeal of this approach is that the pieces needed all exist. Are you talking of http://mv.ezproxy.com.ezproxyberklee.flo.org/projects/kerb_pki/ as your kx509 implementation? It appears to be based on Kerberos4… -Rick