diff --git a/lib/hx509/cert.c b/lib/hx509/cert.c
index a375e45d9..d9a08ae5d 100644
--- a/lib/hx509/cert.c
+++ b/lib/hx509/cert.c
@@ -101,6 +101,30 @@ init_context_once(void *ignored)
     OpenSSL_add_all_algorithms();
 }
 
+/**
+ * Return a cookie identifying this instance of a library.
+ *
+ * Inputs:
+ *
+ * @context     A krb5_context
+ * @module      Our library name or a library we depend on
+ *
+ * Outputs:     The instance cookie
+ *
+ * @ingroup     krb5_support
+ */
+
+HX509_LIB_FUNCTION uintptr_t HX509_LIB_CALL
+hx509_get_instance(const char *libname)
+{
+    static const char *instance = "libhx509";
+
+    if (strcmp(libname, "hx509") == 0)
+        return (uintptr_t)instance;
+
+    return 0;
+}
+
 /**
  * Creates a hx509 context that most functions in the library
  * uses. The context is only allowed to be used by one thread at each
diff --git a/lib/hx509/libhx509-exports.def b/lib/hx509/libhx509-exports.def
index 007983efe..aaf3c5cf6 100644
--- a/lib/hx509/libhx509-exports.def
+++ b/lib/hx509/libhx509-exports.def
@@ -175,6 +175,7 @@ EXPORTS
 	hx509_free_octet_string_list
 	hx509_general_name_unparse
 	hx509_get_error_string
+	hx509_get_instance
 	hx509_get_one_cert
 	hx509_lock_add_cert
 	hx509_lock_add_certs
diff --git a/lib/hx509/version-script.map b/lib/hx509/version-script.map
index 576ceab2e..737de5f57 100644
--- a/lib/hx509/version-script.map
+++ b/lib/hx509/version-script.map
@@ -159,6 +159,7 @@ HEIMDAL_X509_1.2 {
 		hx509_find_private_alg;
 		hx509_general_name_unparse;
 		hx509_get_error_string;
+		hx509_get_instance;
 		hx509_get_one_cert;
 		hx509_lock_add_cert;
 		hx509_lock_add_certs;