Hi, the patch addresses issue https://fedorahosted.org/pki/ticket/1413. After the PKI meeting, Matt and Endi had a discussion about the verification method on IRC. They fear that there is not enough time to test the new feature thoroughly. I turned the checker into an optional feature. By default strict verification is disabled and the user cfg is not verified at all. # pkispawn --strict -f test.inf -s CA Log file: /var/log/pki/pki-ca-spawn.20150701133808.log Loading deployment configuration from test.inf. pkispawn : ERROR 'Could not parse: 'User configuration contains unsupported option(s) [Tomcat] pki_foo' Christian