diff --git a/lib/krb5/pkinit.c b/lib/krb5/pkinit.c
index f67389a74..185eff365 100644
--- a/lib/krb5/pkinit.c
+++ b/lib/krb5/pkinit.c
@@ -221,10 +221,10 @@ create_signature(krb5_context context,
     int ret, flags = 0;
 
     if (id->cert == NULL)
-	flags = HX509_CMS_SIGNATURE_NO_SIGNER;
+	flags |= HX509_CMS_SIGNATURE_NO_SIGNER;
 
     ret = hx509_cms_create_signed_1(id->hx509ctx,
-				    0,
+				    flags,
 				    eContentType,
 				    eContent->data,
 				    eContent->length,