diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index f780103d0..b80dbf4de 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -536,7 +536,11 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
 
     ret = _kdc_pk_rd_padata(r, pa, &pkp);
     if (ret || pkp == NULL) {
-	ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+        if (ret == HX509_CERT_REVOKED) {
+            ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;
+        } else {
+            ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
+        }
 	_kdc_r_log(r, 4, "Failed to decode PKINIT PA-DATA -- %s",
 		   r->cname);
 	goto out;
diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index d5c98c46f..d6d632cce 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -797,6 +797,8 @@ _kdc_pk_rd_padata(astgs_request_t priv,
     hx509_verify_attach_anchors(cp->verify_ctx, trust_anchors);
     hx509_certs_free(&trust_anchors);
 
+    hx509_verify_attach_revoke(cp->verify_ctx, kdc_identity->revokectx);
+
     if (config->pkinit_allow_proxy_certs)
 	hx509_verify_set_proxy_certificate(cp->verify_ctx, 1);