[libdefaults]
...
 pkinit_anchors = FILE:/etc/krb5/cacert.pem
 pkinit_kdc_hostname = ipa.virt.int
 pkinit_eku_checking = kpServerAuth
 pkinit_identities = PKCS11:librtpkcs11ecp.so