diff --git a/tests/kdc/krb5-pkinit.conf.in b/tests/kdc/krb5-pkinit.conf.in
new file mode 100644
index 000000000..d13468903
--- /dev/null
+++ b/tests/kdc/krb5-pkinit.conf.in
@@ -0,0 +1,32 @@
+# $Id$
+
+[libdefaults]
+	default_realm = TEST.H5L.SE
+	no-addresses = TRUE
+
+[appdefaults]
+	pkinit_anchors = FILE:@objdir@/ca.crt
+
+[realms]
+	TEST.H5L.SE = {
+		kdc = localhost:8888
+	}
+
+[kdc]
+	enable-pkinit = true
+	pkinit_identity = FILE:@objdir@/kdc.crt,@srcdir@/../../lib/hx509/data/key2.der
+	pkinit_anchors = FILE:@objdir@/ca.crt
+	pkinit_mappings_file = @srcdir@/pki-mapping
+
+	database = {
+		dbname = @objdir@/current-db
+		realm = TEST.H5L.SE
+		mkey_file = @objdir@/mkey.file
+	}
+
+[logging]
+	kdc = 0-/FILE:@objdir@/messages.log
+	default = 0-/FILE:@objdir@/messages.log
+
+[kadmin]
+	save-password = true