Although it is not just a PKI patch, this JSS patch was inspired by the work being performed on Dogtag 10:
Please review and ACK the attached patch.

Thanks,
-- Matt