diff --git a/kdc/pkinit.c b/kdc/pkinit.c
index 806aeb512..fe0cc6db6 100644
--- a/kdc/pkinit.c
+++ b/kdc/pkinit.c
@@ -1128,7 +1128,9 @@ _kdc_pk_check_client(krb5_context context,
 	    return 0;
     }
 
-    ret = hx509_cert_get_subject(client_params->cert, &name);
+    ret = hx509_cert_get_base_subject(kdc_identity->hx509ctx, 
+				      client_params->cert,
+				      &name);
     if (ret)
 	return ret;