diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index 8247e75a3..806aeb512 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -827,6 +827,8 @@ pk_mk_pa_reply_dh(krb5_context context,
 					buf.length,
 					NULL,
 					cert,
+					kdc_identity->anchors,
+					kdc_identity->certpool,
 					&signed_data);
 	hx509_cert_free(cert);
     }
diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index d9c6154db..e8ca73038 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -122,7 +122,7 @@ integer_to_BN(krb5_context context, const char *field, const heim_integer *f)
 }
 
 
-krb5_error_code KRB5_LIB_FUNCTION
+static krb5_error_code
 _krb5_pk_create_sign(krb5_context context,
 		     const heim_oid *eContentType,
 		     krb5_data *eContent,
@@ -151,6 +151,8 @@ _krb5_pk_create_sign(krb5_context context,
 				    eContent->length,
 				    NULL,
 				    cert,
+				    NULL,
+				    NULL,
 				    sd_data);
     hx509_cert_free(cert);