diff --git a/doc/Makefile.am b/doc/Makefile.am
index a56587f..0174591 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -1,113 +1,114 @@
 # Makefile.am - Doc directory Makefile for scute.
 # Copyright (C) 2006, 2007 g10 Code GmbH
 #
 # This file is part of Scute.
 #
 # Scute is free software; you can redistribute it and/or modify it
 # under the terms of the GNU Lesser General Public License as
 # published by the Free Software Foundation; either version 2.1 of
 # the License, or (at your option) any later version.
 #
 # Scute is distributed in the hope that it will be useful, but
 # WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 # Lesser General Public License for more details.
 #
 # You should have received a copy of the GNU Lesser General Public
 # License along with this program; if not, see <https://gnu.org/licenses/>.
 # SPDX-License-Identifier: LGPL-2.1-or-later
 
 ## Process this file with automake to produce Makefile.in
 
 images = firefox-cm.png firefox-cm-view-detail.png firefox-cm-view.png \
 	firefox-dm-load-after.png firefox-dm-load-before.png \
 	firefox-dm-load.png firefox-dm-token-present.png firefox-pref.png \
 	firefox-pref-view.png firefox-bad-pin.png \
 	thunderbird-account-settings.png thunderbird-smime-button.png \
 	libreoffice-certificate-selection.png \
 	libreoffice-digital-signatures.png libreoffice-pdf-signature.png
 
 # The same as images but eps suffix.
 images_eps = firefox-cm.eps firefox-cm-view-detail.eps firefox-cm-view.eps \
 	firefox-dm-load-after.eps firefox-dm-load-before.eps \
 	firefox-dm-load.eps firefox-dm-token-present.eps firefox-pref.eps \
 	firefox-pref-view.eps firefox-bad-pin.eps \
 	thunderbird-account-settings.eps thunderbird-smime-button.eps \
 	libreoffice-certificate-selection.eps \
 	libreoffice-digital-signatures.eps libreoffice-pdf-signature.eps
 
 
 EXTRA_DIST = $(images)
 
 CLEANFILES =  $(images_eps)
-DISTCLEANFILES = scute.tmp
+DISTCLEANFILES = scute.tmp yat2m-stamp.tmp yat2m-stamp $(myman_pages)
+
 
 BUILT_SOURCES = $(images_eps)
 
 info_TEXINFOS = scute.texi
 scute_TEXINFOS = lesser.texi
 
 YAT2M = yat2m
 YAT2M_OPTIONS = -I $(srcdir) \
 	--release "Scute @PACKAGE_VERSION@" --source "Scute"
 
 myman_sources = scute.texi
 myman_pages   = scute.7
 
 man_MANS = $(myman_pages)
 
 
 .png.eps:
 	$(CONVERT) `test -f '$<' || echo '$(srcdir)/'`$< $@
 
 .png.pdf:
 	$(CONVERT) `test -f '$<' || echo '$(srcdir)/'`$< $@
 
 yat2m-stamp: $(myman_sources)
 	@rm -f yat2m-stamp.tmp
 	@touch yat2m-stamp.tmp
 	for file in $(myman_sources) ; do \
             $(YAT2M) $(YAT2M_OPTIONS) --store \
 	          `test -f '$$file' || echo '$(srcdir)/'`$$file ; done
 	@mv -f yat2m-stamp.tmp $@
 
 $(myman_pages) : yat2m-stamp
 	@if test -f $@; then :; else \
             trap 'rm -rf yat2m-stamp yat2m-lock' 1 2 13 15; \
                if mkdir yat2m-lock 2>/dev/null; then \
                  rm -f yat2m-stamp; \
                  $(MAKE) $(AM_MAKEFLAGS) yat2m-stamp; \
                  rmdir yat2m-lock; \
                else \
                  while test -d yat2m-lock; do sleep 1; done; \
                  test -f yat2m-stamp; exit $$?; \
                fi; \
              fi
 
 
 
 
 # Do not include the generated EPS files.
 dist-hook:
 	cd $(distdir) && rm -f $(images_eps)
 
 
 # Make sure that scute.texi is touched if any other source file has
 # been modified.  This is required so that the version.texi magic
 # updates the release date.
 scute.texi : $(scute_TEXINFOS) $(images)
 	touch $(srcdir)/scute.texi
 
 
 online: scute.html scute.pdf
 	set -e; \
 	echo "Uploading current manuals to www.gnupg.org ..."; \
 	for f in $(images); do \
           cp $(srcdir)/$$f scute.html/; \
 	done ; \
         user=werner ; webhost="ftp.gnupg.org"; \
 	rsync -v scute.pdf \
               $${user}@$${webhost}:webspace/manuals/ ; \
 	cd scute.html ; \
         rsync -vr -C .  \
               $${user}@$${webhost}:webspace/manuals/scute/
diff --git a/doc/scute.texi b/doc/scute.texi
index 0df0f15..a449ed7 100644
--- a/doc/scute.texi
+++ b/doc/scute.texi
@@ -1,993 +1,993 @@
 \input texinfo                  @c -*- Texinfo -*-
 @c %**start of header
 @setfilename scute.info
 @include version.texi
 @settitle The Scute Manual
 @c Unify some of the indices.
 @syncodeindex tp fn
 @syncodeindex pg fn
 @c %**end of header
 
 @copying
 This is @cite{The Scute Manual} for Scute version @value{VERSION} and was
 last updated @value{UPDATED}.  Scute is a PKCS#11 provider on top of GnuPG.
 
 @noindent
 Copyright @copyright{} 2006, 2007, 2008, 2009, 2010, 2017, 2019, 2020
 g10 Code GmbH.
 
 @quotation
 The Scute Manual is free software; you can redistribute it and/or
 modify it under the terms of the GNU Lesser General Public License as
 published by the Free Software Foundation; either version 2.1 of the
 License, or (at your option) any later version.  The text of the
 license can be found in the section entitled ``Library Copying''.
 
 The Scute Manual is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser
 General Public License for more details.
 @end quotation
 @end copying
 
 
 @dircategory GnuPG
 @direntry
-* Scute: (scute).          PKCS #11 module for GnuPG supported tokens.
+* Scute: (scute).          PKCS#11 module for GnuPG supported tokens.
 @end direntry
 
 @c A couple of macros with no effect on texinfo
 @c but used by the yat2m processor.
 @macro manpage {a}
 @end macro
 @macro mansect {a}
 @end macro
 @macro manpause
 @end macro
 @macro mancont
 @end macro
 
 @c
 @c Printing stuff taken from gcc.
 @c
 @macro gnupgtabopt{body}
 @code{\body\}
 @end macro
 
 
 @c
 @c Titlepage
 @c
 @setchapternewpage odd
 @titlepage
 @title The Scute Manual
 @subtitle Version @value{VERSION}
 @subtitle @value{UPDATED}
 @author g10 Code GmbH
 
 @page
 @vskip 0pt plus 1filll
 @insertcopying
 @end titlepage
 
 @ifnothtml
 @c @summarycontents
 @contents
 @page
 @end ifnothtml
 
 
 @ifnottex
 @node Top
 @top The Scute Manual
 @insertcopying
 @sp 1
 @end ifnottex
 
 @menu
 * Introduction::                  How to use this manual.
 * Preparation::                   What you should do before using Scute.
 * Client Authentication::         How to use Scute for client authentication.
 * Email Signing::                 How to use Scute for S/MIME email signing.
 * Document Signing::              How to use Scute with LibreOffice.
 * Troubleshooting::               What to do when things go wrong.
 * Internals::                     Technical details about Scute.
 * Library Copying::               The GNU General Public License says
                                   how you can copy and share Scute.
 
 @c Indices
 @c
 @c * Concept Index::                 Index of concepts and programs.
 
 
 @ifnothtml
 @detailmenu
  --- The Detailed Node Listing ---
 
 Introduction
 
 * Getting Started::               Purpose of the manual, and how to use it.
 * Features::                      Reasons to install and use Scute.
 * Overview::                      Basic architecture of the Scute module.
 
 Preparation
 
 * Prerequisites::                 Dependencies of Scute.
 * Building the Source::           How to build Scute.
 * Certificate Preparation::       Preparing certificates for use with Scute.
 
 Client Authentication
 
 * Application Configuration::     Preparing the application for use with Scute.
 * Authentication With Service::   Using Scute for client authentication.
 
 Email Signing
 
 Document Signing
 
 Troubleshooting
 
 Internals
 
 * Features and Limitations::      Details about the interfaces implemented.
 * Developing Scute::              How to understand or improve Scute.
 * Mozilla Compatibility::         Interoperability notes for Mozilla NSS.
 
 
 @end detailmenu
 @end ifnothtml
 @end menu
 
 @c @ifhtml
 @c @page
 @c @summarycontents
 @c @contents
 @c @end ifhtml
 
 
 @c ************************************
 @c ****  BEGIN man page  **************
 @c ************************************
 @ifset isman
 @manpage scute.7
 @mansect 7
 @ifset manverb
 .B scute
 \- The GnuPG PKCS#11 provider
 @end ifset
 @mansect synopsis
 @ifset manverb
 .B scute.so
 @end ifset
 @mansect description
-Scute is a PKCS #11 implementation for the GnuPG Agent using the GnuPG
+Scute is a PKCS#11 implementation for the GnuPG Agent using the GnuPG
 Smart Card Daemon.  Currently, OpenPGP and PIV cards are supported.
 
 Scute enables the use of the OpenPGP smart card or a PIV smart card in
-applications supporting PKCS #11 compliant security tokens.  The main
+applications supporting PKCS#11 compliant security tokens.  The main
 application at this time is client authentication in Mozilla-based web
 browsers.  In the future, other applications will be supported.
 
 To prepare your application for use with Scute, you have to load the
-Scute module as a PKCS #11 module into the application.  See below for
+Scute module as a PKCS#11 module into the application.  See below for
 notes on how to do that with Firefox.
 
 @mansect options
 @noindent
 As a shared library, @command{scute} has no command line options but
 its behaviour can be modified by the use of a global configuration
 file or with an environment variable (see below).  The global
 configuration file is expected as @file{/etc/gnupg/scute.conf}.  It
 consists of keywords and values and some meta commands.  There is
 currently only one useful option for general use, the other options
 are used for debugging.  @command{Scute} uses the same parser as GnuPG
 does; thus for the meta commands please consult the GnuPG description.
 
 @noindent
 Here is the short list of supported keywords:
 @table @gnupgtabopt
 
 @item user @var{name}
 @opindex user
 If Scute is running with root permission and this option is used it
 runs the GnuPG components in the context of the user @var{name}.
 @var{name} may either be a name or a numerical UID.  This allows to
 use the GnuPG setup of a certain user instead of running it under the
 root account.  This is needed to make Scute work smoothly as a PKCS#11
 provider for OpenVPN.  If the current user is not root, this option has
 no effect.
 
 @item debug @var{flag}
 @opindex debug
 Useful values for @var{flag} are 1 and 3.
 
 
 @item log-file @var{file}
 @opindex log-file
 This has currently no effect but will in a future version write the
 log to @var{file}.  Writing to a socket will be possible by prefixing
 the @var{file} with the string @code{socket://}.
 
 @end table
 
 @mansect notes (Firefox)
 To use Scute with Firefox or Thunderbird, follow these instructions:
 
 From the menu choose @code{Edit->Preferences}.  In the preferences
 configuration dialog, you then select the @code{Advanced}
 configuration section, then the @code{Security} tab, and then select
 @code{Security Devices} in the category @code{Certificates}.  In the
-devices manager dialog, you can select @code{Load} to load a new PKCS
-#11 device.  In the pop-up dialog that follows, you can give a module
+devices manager dialog, you can select @code{Load} to load a new
+PKCS#11 device.  In the pop-up dialog that follows, you can give a module
 name (e.g. ``@code{Scute}'') and a module filename.  The latter should
 correspond to the full file name of the installed Scute module file
 @file{scute.so}.
 
 The default installation path is @file{/usr/local/lib}, which would
 mean that you have to provide the file name
 @file{/usr/local/lib/scute.so}.  If you or your system administrator
 installed Scute in a different location, you have to adjust the file
 name correspondingly.
 
 After confirming installation of the security device, a pop-up window
 should confirm that the module was successfully loaded, and an entry for
 the security device should appear in the device manager list of
 
 @mansect environment
-The environment variable @code{SCUTE_DEBUG} gives the same debug
-flags as described above.  This numerically value may be followed by
-collon and a log filename.  The global options will override these
+The environment variable @code{SCUTE_DEBUG} gives the same debug flags
+as described above.  This numerically value may be followed by a colon
+and the name for the log file.  The global options will override these
 values once they have been parsed.
 
 @mansect see also
 @command{scdaemon}(1)
 @command{gpgsm}(1)
 
 @manpause
 @end ifset
 @c ************************************
 @c ****  END man page  ****************
 @c ************************************
 
 
 
 @node Introduction
 @chapter Introduction
 
-Scute is a PKCS #11 implementation for the GnuPG Agent using the GnuPG
+Scute is a PKCS#11 implementation for the GnuPG Agent using the GnuPG
 Smart Card Daemon.  Currently, OpenPGP and PIV cards are supported.
 
 Scute enables the use of the OpenPGP smart card or a PIV smart card in
-applications supporting PKCS #11 compliant security tokens.  The main
+applications supporting PKCS#11 compliant security tokens.  The main
 application at this time is client authentication in Mozilla-based web
 browsers.  In the future, other applications will be supported.
 
 
 @menu
 * Getting Started::               Purpose of the manual, and how to use it.
 * Features::                      Reasons to install and use Scute.
 * Overview::                      Basic architecture of the Scute module.
 @end menu
 
 
 @node Getting Started
 @section Getting Started
 
 This manual documents the Scute module, how it can be used for common
 applications supported by it, and how it can be extended and improved by
 programmers.  It is thus a user manual as well as a developer manual.
 
 The reader is assumed to possess basic knowledge about cryptography in
 general, and public key cryptography in particular.  The underlying
 cryptographic engines that are used by the library are not explained,
 but where necessary, special features or requirements are provided.
 
 This manual can be used in several ways.  If read from the beginning to
 the end, it gives a good introduction into the module and how it can be
 used in an application.  Forward references are included where
 necessary.  Later on, the manual can be used as a reference manual to
 get just the information needed about any particular application of the
 module.
 
 
 @node Features
 @section Features
 
-Scute is currently the only implementation of PKCS #11 for the OpenPGP
+Scute is currently the only implementation of PKCS#11 for the OpenPGP
 smart card.  Apart from that, it offers a couple of other benefits:
 
 @table @asis
 @item it's free software
 Anybody can use, modify, and redistribute it under the terms of the GNU
 General Public License (@pxref{Library Copying}).
 
 @item it's built to grow
 Although Scute initially provided a single function, client
 authentication using OpenPGP smart cards in Mozilla-based web browsers,
 it was built with the intention of supporting other applications as well
 in the future.
 
 @item it's easy
 Building and installing Scute is easy, and preparing smart cards for use
 with Scute is a snatch using the GnuPG 2 framework.  The integration
 of Scute into the application is seamless.
 @end table
 
 
 @node Overview
 @section Overview
 
-Scute is a security device that implements the PKCS #11 interface for
-security tokens.  Applications which know how to use the PKCS #11
+Scute is a security device that implements the PKCS#11 interface for
+security tokens.  Applications which know how to use the PKCS#11
 interface to access security tokens for cryptographic operations can use
 Scute to access the OpenPGP smart card.  An important example of such an
 application is the Firefox web browser by the Mozilla project, which
 uses the Mozilla Network Security Services library (NSS).
 
 Scute itself does not include a driver for the smart card itself.
 Instead, it uses the GnuPG 2 framework to access the smart cards and
 associated data like certificates.  Scute acts as the glue between the
 application and GnuPG 2.
 
 Currently supported usages are client authentication over HTTPS with
 Firefox (allowing users to authenticate themselves to a remote web
 service without entering their log-in information), email signing
 with Thunderbird, and document signing with LibreOffice.
 
 
 @node Preparation
 @chapter Preparation
 
 To use Scute, you first have to install the software.  You also have to
 prepare each card you want to use with Scute before it can be used.
 Furthermore, you need to configure the application to make use of Scute
 for cryptographic operations.  This chapter explains each of these steps
 in detail.
 
 @menu
 * Prerequisites::                 Dependencies of Scute.
 * Building the Source::           How to build Scute.
 * Certificate Preparation::       Preparing certificates for use with Scute.
 @end menu
 
 
 @node Prerequisites
 @section Prerequisites
 
 There are two types of dependencies for Scute: compile-time dependencies
 and run-time dependencies.  The compile-time dependencies only need to
 be fulfilled when Scute is compiled and installed.  The run-time
 dependencies need to be fulfilled when Scute is used in an application.
 
 Scute depends, in addition to the essential build utilities, on the
 following packages at build time:
 
 @table @code
 @item libgpg-error
 Scute uses the GnuPG 2 framework for error handling, so it depends on
 the GPG error library.  The minimum version required is 1.38.
 
 @item libassuan
 Scute uses the GnuPG  framework for communication with the GPG
 Agent, so it also depends on the Assuan library.  The minimum version
 required is 2.5.0.
 @end table
 
 At run-time, in addition to the run-time versions of the above
 libraries, you also need the following packages installed and
 configured:
 
 @table @asis
 @item GnuPG
 Scute uses the GnuPG 2 framework to access the OpenPGP card and for
 certificate management.  The minimum version required is 2.2.0.  For
 full functionality, in particular for use with the OpenVPN software,
 GnuPG version 2.3 is required.
 
 @item Pinentry
 Pinentry is a dependency of GnuPG 2, so it also needs to be installed
 with it.
 
 @item Firefox et al.
 Firefox is the first application supported by Scute.  In the future,
 other applications may be supported.  The applications are not
 dependencies of Scute, but Scute can not be used stand-alone, so you can
 not experience it without an application.
 @end table
 
 
 @node Building the Source
 @section Building the Source
 
 Scute does comply to the GNU coding standards and thus can be compiled
 and installed according to the generic installation instructions found
 in the source package in the file @code{INSTALL}.  There are no Scute
 specific options to the configure script.
 
 After installation, the @code{scute.so} module file can be found in
 the library directory of the installation path.
 
 
 @node Certificate Preparation
 @section Certificate Preparation
 
 To use an OpenPGP card with Scute, it first has to be initialized by
 generating or loading a key on the card, see
 @uref{http://www.gnupg.org/(en)/howtos/card-howto/en/smartcard-howto.html,
 the OpenPGP Card How-To}.  Then a certificate has to be created and
 imported into GPGSM.  This task involves three steps: First, a
 certificate signing request (@acronym{CSR}) has to be created that
 matches the key on the card.  This certificate signing request then has
 to be submitted to a certificate authority (@acronym{CA}), which will
 create the certificate and send it back to you.  At last, the
 certificate has to be imported into GPGSM.  This section will explain
 all of these steps in detail.
 
 @menu
 * Creating a CSR::                How to create a card-based CSR.
 * Signing the CSR::               Obtain a certificate from the CSR.
 * Importing the Certificate::     How to import the certificate into GPGSM.
 * On-card Certificate::           How to store the certificate on the card.
 @end menu
 
 @node Creating a CSR
 @subsection Creating a CSR
 
 Before you start, make sure that the GPG Agent is running, see
 @ref{Prerequisites} and that your card is in the reader.  There is no
 need to configure GPGSM, so you can create a CSR with the command:
 
 @example
 $ gpgsm --gen-key > floppy-head.csr
 Please select what kind of key you want:
    (1) RSA
    (2) Existing key
    (3) Existing key from card
 Your selection? 3
 @end example
 
 As we create a certificate for the OpenPGP Card, the option ``@code{[3]
 Direct from card}'' should be selected.
 
 @example
 Serial number of the card: 355F9746499F0D4B4ECEE4928B007D16
 Available keys:
    (1) D53137B94C38D9BF6A199706EA6D5253 OPENPGP.1
    (2) B0CD1A9DFC3539A1D6A8B851A11C8665 OPENPGP.2
    (3) 53DB41052CC590A40B403F3E6350E5DC OPENPGP.3
 Your selection? 3
 Possible actions for a RSA key:
    (1) sign, encrypt
    (2) sign
    (3) encrypt
 Your selection? 2
 @end example
 
 The only operation currently supported is client authentication.  For
 this, the authentication key has to be selected.  This is the third key
 on the card, so the options ``@code{[3] OPENPGP.3}'' and ``@code{[2]
 sign}'' should be chosen.  Note that the key usage is only advisory, and
 the CA may assign different capabilities.
 
 @example
 Enter the X.509 subject name: CN=Floppy Head,OU="Webserver Team",O="Snake Oil, Ltd",L="Snake Town",ST="Snake Desert",C=XY
 Enter email addresses (end with an empty line):
 > floppy.head@@example.org
 >
 Enter DNS names (optional; end with an empty line):
 >
 Enter URIs (optional; end with an empty line):
 >
 Create self-signed certificate? (y/N) n
 @end example
 
 As a last step, the common name and e-mail address of the key owner need
 to be specified by you.  The above are only an example for a fictious
 person working at a fictious company.  DNS names are only meaningful for
 server certificates and thus should be left empty.
 
 We have now entered all required information and gpgsm will display what
 it has gathered and ask whether to create the certificate request:
 
 @example
 These parameters are used:
     Key-Type: card:OPENPGP.3
     Key-Length: 1024
     Key-Usage: sign
     Name-DN: CN=Floppy Head,OU="Webserver Team",O="Snake Oil, Ltd",L="Snake Town",ST="Snake Desert",C=XY
     Name-Email: floppy.head@@example.org
 
 Proceed with creation? (y/N) y
 Now creating certificate request.  This may take a while ...
 gpgsm: about to sign the CSR for key: &53DB41052CC590A40B403F3E6350E5DC
 @end example
 
 GPGSM will now start working on creating the request.  During this time
 you will be asked once for a passphrase to unprotect the authentication
 key on the card.  A pop up window will appear to ask for it.
 
 When it is ready, you should see the final notice:
 
 @example
 gpgsm: certificate request created
 Ready.  You should now send this request to your CA.
 @end example
 
 Now, you may look at the created request:
 
 @example
 $ cat floppy-head.csr
 -----BEGIN CERTIFICATE REQUEST-----
 MIICCDCCAXECAQAwgYExCzAJBgNVBAYTAlhZMRUwEwYDVQQIEwxTbmFrZSBEZXNl
 cnQxEzARBgNVBAcTClNuYWtlIFRvd24xFzAVBgNVBAoTDlNuYWtlIE9pbCwgTHRk
 MRcwFQYDVQQLEw5XZWJzZXJ2ZXIgVGVhbTEUMBIGA1UEAxMLRmxvcHB5IEhlYWQw
 gaAwDQYJKoZIhvcNAQEBBQADgY4AMIGKAoGBANWaM9YS89AOx3GX1Rua+4DUHwbL
 wt0rBYdBddlabMMteVjUcOOhbFMirLpLAi1S8fUXNiy84ysOmFStmvSIXDsAgXq5
 1ESOU4SNg2zEkPDF1WYJ5BFIXdYq9i2k5W7+ctV8PkKv3e5IeYXTa5qppIPD31de
 gM8Qj7tK0hL/eNCfAgQAAQABoEUwQwYJKoZIhvcNAQkOMTYwNDAiBgNVHREEGzAZ
 gRdmbG9wcHkuaGVhZEBleGFtcGxlLmNvbTAOBgNVHQ8BAf8EBAMCBsAwDQYJKoZI
 hvcNAQEFBQADgYEAFC9q6+ib9YGCLB/2AlZR+/dvb+pEeXR1EbpV/dw/gjP1yPY6
 29n8ZIDLUvQvNCtfCcXFxFimVSSB/KmFXXsJbM+NXQyT6Ocn34iHmkf9IVRMWQWg
 ZBYfQVeXAd7XlxI6d1wXDLwD/26lTU/rH2JU6H1+zSfZxqwVC4Iu+kiN4Y8=
 -----END CERTIFICATE REQUEST-----
 $
 @end example
 
 @node Signing the CSR
 @subsection Signing the CSR
 
 The next step is to submit this certificate request to the CA, which can
 then create a certificate and send it back to you.
 
 If, for example, you use the CA @uref{http://www.cacert.org, CAcert},
 then you can log into your account at the CAcert website, choose
 ``Client Certificates -> New'', check ``Show advanced options'', paste
 the above request block into the text field and click on ``Submit''.
 If everything works correctly, a certificate will be shown, which you
 can cut and paste into a new file @file{floppy-head.crt}.
 
 Alternatively if, for example, you set up your own CA with OpenSSL, then
 you can create your own certificate by issueing a command similar
 @code{openssl ca -in floppy-head.csr -cert snakeoil-ca-rsa.crt -keyfile
 snakeoil-ca-rsa.key -out floppy-head.crt}.  Please see the OpenSSL
 documentation for more details on how to set up and administrate a
 certificate authority infrastructure.
 
 @node Importing the Certificate
 @subsection Importing the Certificate into GPGSM
 
 Once the CSR has been signed, you should end up with a certificate file
 @file{floppy-head.crt}, which you then have to import into GPGSM.  It is
 also recommended that you import the root certificate of the CA first in
 the same fashion.
 
 @example
 $ gpgsm --import floppy-head.crt
 gpgsm: certificate imported
 
 gpgsm: total number processed: 1
 gpgsm:               imported: 1
 @end example
 
 gpgsm tells you that it has imported the certificate.  It is now
 associated with the key you used when creating the request.  To see the
 content of your certificate, you may now enter:
 
 @example
 $ gpgsm -K Floppy
 /home/foo/.gnupg/pubring.kbx
 ---------------------------
 Serial number: 10
        Issuer: /CN=Snake Oil CA/OU=Certificate Authority/O=Snake Oil, Ltd/L=Snake Town/ST=Snake Desert/C=XY/EMail=ca@@snakeoil.dom
       Subject: /CN=Floppy Head/OU=Webserver Team/O=Snake Oil, Ltd/ST=Snake Desert/C=XY
      validity: 2006-11-11 14:09:12 through 2007-11-11 14:09:12
      key type: 1024 bit RSA
   fingerprint: EC:93:A2:55:C6:58:7F:C9:9E:96:DB:12:6E:64:99:54:BB:E1:94:68
 @end example
 
 The option ``@code{-K}'' is used above because this will only list
 certificates for which a private key is available.  To see more details,
 you may use ``@code{--dump-secret-keys}'' instead of ``@code{-K}''.
 
 @node On-card Certificate
 @subsection Loading the Certificate onto the Card
 
 This step is optional. You may choose to store the certificate directly
 into your OpenPGP card. The benefit of doing so is that Scute will then
 be able to fetch the certificate from the card without having to look
 into the GPGSM store.
 
 You need your certificate in the DER format. Export it from the GPGSM
 store with the following command:
 
 @example
 $ gpgsm -o floppy-head.crt --export Floppy
 @end example
 
 Then, fire up the GnuPG card editor to transfer the certificate to the
 card (note that the @code{writecert} command is not listed in the
 editor's online help):
 
 @example
 $ gpg2 --card-edit
 
 Application ID ...: D27600012301020000005000012340000
 [...]
 
 gpg/card> admin
 Admin commands are allowed
 
 gpg/card> writecert 3 < floppy-head.crt
 
 gpg/card> quit
 @end example
 
 
 @node Client Authentication
 @chapter Client Authentication
 
 @menu
 * Application Configuration::     Preparing the application for use with Scute.
 * Authentication With Service::   Using Scute for client authentication.
 @end menu
 
 Scute allows you to authenticate yourself to a website securely without
 entering a username or password by simply using your OpenPGP card.
 Currently, only Mozilla-based browsers like Firefox are supported,
-although other applications using Mozilla NSS or supporting PKCS #11
+although other applications using Mozilla NSS or supporting PKCS#11
 modules may work.
 
 
 @node Application Configuration
 @section Application Configuration
 
 To prepare your application for use with Scute, you have to load the
-Scute module as a PKCS #11 module into the application.  With Firefox,
+Scute module as a PKCS#11 module into the application.  With Firefox,
 this can be done by choosing @code{Edit->Preferences} in the menu.  In
 the preferences configuration dialog, you should select the
 @code{Advanced} configuration section, then the @code{Security} tab, and
 then select @code{Security Devices} in the category @code{Certificates}.
 
 @center @image{firefox-pref,13cm}
 
 In the devices manager dialog, you can select @code{Load} to load a new
 PKCS #11 device.
 
 @center @image{firefox-dm-load-before,13cm}
 
 In the pop-up dialog that follows, you can give a module name
 (e.g. ``@code{Scute}'') and a module filename.  The latter should
 correspond to the full file name of the installed Scute module file
 @file{scute.so}.  The default installation path is
 @file{/usr/local/lib}, which would mean that you have to provide the
 file name @file{/usr/local/lib/scute.so}.  If you or your system
 administrator installed Scute in a different location, you have to
 adjust the file name correspondingly.
 
 @center @image{firefox-dm-load,8cm}
 
 After confirming installation of the security device, a pop-up window
 should confirm that the module was successfully loaded, and an entry for
 the security device should appear in the device manager list of
 @code{Security Modules and Devices}.
 
 @center @image{firefox-dm-load-after,15cm}
 
 When you insert the OpenPGP card for which you generated and imported a
 certificate earlier (see @ref{Certificate Preparation}), the device
 manager should detect this security token and display some information
 about it in the @code{Details} list when you select it from the module
 list.
 
 @center @image{firefox-dm-token-present,15cm}
 
 The client certificate will show up in the @code{Certificate Manager}
 under @code{Your Certificates}:
 
 @center @image{firefox-cm,13cm}
 
 @node Authentication With Service
 @section Authentication With Service
 
 Before you access a web service which requires client authentication,
 for instance a fictious web service
 @ifnottex
 @indicateurl{https://example.com},
 @end ifnottex
 @iftex
 @code{https://example.com},
 @end iftex
 the OpenPGP card should be present.  In this case, a pop-up window will
 appear that requests you to enter the PIN number protecting the
 authentication key on the OpenPGP card.  After entering the PIN number,
 your browser will be authenticated to the server.  If the server accepts
 your request and certificate, this is all which is required.  You should
 leave the card in the reader as long as the connection persists.
 Depending on how aggressively GPG Agent caches your PIN number, you may
 have to enter the PIN number again later to keep up the connection to
 the server.
 
 If the card is not present, or you enter the wrong PIN, or the server
 does not admit your certificate, you will get an error message.  This
 error message is generated by the application and Scute can not
 influence it.  Unfortunately, in Firefox (at least up to version
 38.5.0), this error message is not very user friendly.  For example,
 entering a bad PIN results in the following generic error message, and
 the @code{Try Again} button does not work as expected:
 
 @center @image{firefox-bad-pin,11cm}
 
 @comment FIXME: Document possible error codes.
 
 
 @node Email Signing
 @chapter Email Signing
 
 Scute also allows you to use your card-based X.509 certificate to sign
 your emails with the S/MIME signature format.  This has been tested
 with Mozilla Thunderbird only, but should work with any mail client
 with support for PKCS #11 (notably GNOME Evolution).
 
 You must first load the Scute module into your mail client.  With
 Mozilla Thunderbird, the procedure is the same as the one described
 above for Mozilla Firefox.
 
 Then, open your account configuration dialog (@code{Edit->Account
 Settings}), and in the @code{Security} tab, under the section
 @code{Digital Signing}, use the @code{Select...} button to associate
 your card-based certificate with your account.
 
 @center @image{thunderbird-account-settings,13cm}
 
 When writing a new message, you may then use the @code{S/MIME} button
 and select @code{Digitally sign this message} in the popup menu.  You
 will be prompted for your User PIN before the message is sent.
 
 @center @image{thunderbird-smime-button,13cm}
 
 
 @node Document Signing
 @chapter Document Signing
 
 Scute can also be used with LibreOffice to sign OpenDocument files.
 
 First, you must load the Scute module into Mozilla Firefox according to
 the above procedure.  Then, configure LibreOffice to use Firefox's
 certificate store by defining the @code{MOZILLA_CERTIFICATE_FOLDER}
 environment variable to your Firefox profile directory.
 
 Then, to sign the document you are editing, select the
 @code{File->Digital Signatures...} menu option to open the
 @code{Digital Signatures} dialog.
 
 @center @image{libreoffice-digital-signatures,13cm}
 
 Click the @code{Sign Document} button to open the certificate selection
 dialog.  Select your card-based certificate, then validate.  Enter your
 User PIN when prompted by GPG Agent.
 
 @center @image{libreoffice-certificate-selection,13cm}
 
 You may also sign a PDF export of your document.  Select the
 @code{File->Export as PDF...} menu option to open the @code{PDF Options}
 dialog.  In the @code{Digital Signatures} tab, use the @code{Select}
 button to open the certificate selection dialog as above.  You will be
 prompted for your User PIN when you will click the @code{Export} button.
 
 @center @image{libreoffice-pdf-signature,13cm}
 
 
 @node Troubleshooting
 @chapter Troubleshooting
 
 @strong{Symptom:} Loading the Scute security device in the security
 device manager of Firefox fails with "Unable to load module".
 
 @strong{Solution:} Make sure that Scute is correctly installed, and that
 all libraries and executables are available.  If you are using GnuPG
 2.0 (instead of 2.1), you may need to make sure that the GPG Agent is
 running and can be found via the environment variable
 @code{GPG_AGENT_INFO}.  @xref{Invoking GPG-AGENT, , , gnupg, Using the
 GNU Privacy Guard}, for details on how to run the GPG Agent.
 
 
 @strong{Symptom:} Client authentication fails with "<example.com> has
 received an incorrect or unexpected message.  Error code: -12227".
 
 @strong{Solution:} Make sure that the correct OpenPGP card is inserted
 and the certificate available in GPGSM.  Check that the OpenPGP card is
 detected correctly in the security device manager and the corresponding
 certificate is displayed in the certificate manager of Firefox.
 @xref{Authentication With Service}.
 
 
 @strong{Symptom:} The OpenPGP card is detected and displayed in the
 security device manager in Firefox, but no corresponding certificate is
 displayed in the certificate manager of Firefox.
 
 @strong{Solution:} Make sure that the corresponding certificate is
 imported in GPGSM.
 
 @comment FIXME: Can this really happen???
 
 
 @node Internals
 @chapter Internals
 
 The following notes are intended for people interested in more technical
 details about Scute and its implementation.  They give an overview about
 its scope and potential compatibility issues with applications.
 
 @menu
 * Features and Limitations::      Details about the interfaces implemented.
 * Developing Scute::              How to understand or improve Scute.
 * Mozilla Compatibility::         Interoperability notes for Mozilla NSS.
 @end menu
 
 
 @node Features and Limitations
 @section Features and Limitations
 
 Scute implements version 2.20 of the
 @uref{https://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs-11-cryptographic-token-interface-standard.htm, PKCS #11}
 specification.
 
 The @uref{http://www.g10code.com/p-card.html,OpenPGP smart card}
 application is supported in read-only mode.
 
 The following functions are not supported:
 
 @table @code
 @item C_Initialize
 No support for native thread package.  Locking callbacks must be
 provided if multi-threaded operation is desired.
 
 @item C_WaitForSlotEvent
 Not implemented.  The interface as specified by PKCS #11 is broken
 anyway, as the function can not safely be canceled.  Thus, we require
 polling.
 
 @item C_GetOperationState
 @itemx C_SetOperationState
 Not supported.
 
 @item C_InitToken
 
 @itemx C_InitPIN
 @itemx C_SetPIN
 Not supported.  No write operations are allowed.  To configure the
 token, please use the tools accompanying the GnuPG software suite.
 
 @item C_Login
 @itemx C_Logout
 Not supported.  No login into the token by the software is required.
 Passphrase queries are implemented by the use of GPG Agent and Pinentry.
 
 @item C_EncryptInit
 @itemx C_Encrypt
 @itemx C_EncryptUpdate
 @itemx C_EncryptFinal
 @itemx C_DigestInit
 @itemx C_Digest
 @itemx C_DigestUpdate
 @itemx C_DigestKey
 @itemx C_DigestFinal
 @itemx C_VerifyInit
 @itemx C_Verify
 @itemx C_VerifyUpdate
 @itemx C_VerifyFinal
 @itemx C_VerifyRecoverInit
 @itemx C_VerifyRec
 Not supported.  Only secret key operations are supported.
 
 @item C_DecryptInit
 @itemx C_Decrypt
 Not yet supported, but will be in the future.
 
 @item C_SignUpdate
 @itemx C_SignFinal
 @itemx C_DecryptUpdate
 @itemx C_DecryptFinal
 No progressive crypto-operations are supported.
 
 @item C_SignRecoverInit
 @itemx C_SignRecover
 Not supported.
 
 @item C_DigestEncryptUpdate
 @itemx C_DecryptDigestUpdate
 @itemx C_SignEncryptUpdate
 @itemx C_DecryptVerifyUpdate
 Dual-purpose cryptographic functions are not supported.
 
 @item C_GenerateKey
 @itemx C_GenerateKeyPair
 @itemx C_WrapKey
 @itemx C_UnwrapKey
 @itemx C_DeriveKey
 Key management functions are not supported.  Please use the tools
 accompanying the GnuPG software suite to generate and import keys for
 use with the token.
 
 @item C_SeedRandom
 Not supported.
 
 @item C_CreateObject
 @itemx C_CopyObject
 @itemx C_DestroyObject
 @itemx C_SetAttributeValue:
 Only read-only operations are supported on objects.
 
 @item C_GetObjectSize
 Not supported.
 
 @item CKO_CERTIFICATE
 The label specifies the key on the card used (e.g. @code{OPENPGP.3}).
 The ID is the fingerprint.
 
 @item CKO_PRIVATE_KEY:
 The @code{CKA_LOCAL} attribute can not be supported by the OpenPGP card.
 It is always set to false (as the key on the card may be copied to the
 card from an external source).
 @end table
 
 @node Developing Scute
 @section Developing Scute
 
 Scute is single-threaded.  There is a global lock that is taken in all
 entry points of Scute, except for @code{C_Initialize},
 @code{C_Finalize}, @code{C_GetFunctionList}, and stubs.
 
 Here are a couple of hints on how to develop PKCS #11 modules for
 Mozilla:
 
 @code{libopensc2} ships with a @code{pkcs11-spy} library that can be
 loaded as a wrapper around the PKCS #11 library you want to use to log
 all functions invoked by Mozilla.  Here is how to use it:
 
 Set the @code{PKCS11SPY_OUTPUT} environment variable to a filename.
 @code{pkcs11-spy} appends its log messages at the end of this file.  Set
 the @code{PKCS11SPY} environment variable to the filename of the PKCS
 #11 module you actually want to use.  Start Mozilla within this
 environment.
 
 There is a different, probably more powerful way to debug Mozilla PKCS
 #11 libraries.  However, to be able to use it, you need to configure and
 compile the Mozilla NSS sources with @code{--enable-debug}.
 Instructions can be found at:
 @uref{https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/nss_tech_notes}
 
 Here are a couple of links to more information about implementing a
 PKCS #11 module for Mozilla:
 
 @table @uref
 @item https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11_Implement
 Guidelines for implementors of PKCS #11 modules targeting Mozilla
 
 @item http://www-archive.mozilla.org/projects/security/pki/pkcs11/
 PKCS #11 Conformance Testing
 
 @item https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS
 The Mozilla NSS web page
 @end table
 
 
 @node Mozilla Compatibility
 @section Mozilla Compatibility
 
 Mozilla has a bug that causes the wrong security device to be unloaded
 when unloading a security device.  Also, the displayed list becomes
 corrupt. When closing and reopening the security device manager, the
 list displayed is correct, but in anyway the wrong security module is
 unloaded.
 
 
 @include lesser.texi
 
 @c An index with just one item does not make any sense.
 @c @node Concept Index
 @c @unnumbered Concept Index
 @c
 @c @printindex cp
 
 @bye
diff --git a/tests/t-findobjects.c b/tests/t-findobjects.c
index f0e02b5..8df5b3e 100644
--- a/tests/t-findobjects.c
+++ b/tests/t-findobjects.c
@@ -1,110 +1,139 @@
 /* t-findobjects.c - Regression test.
  * Copyright (C) 2006 g10 Code GmbH
  *
  * This file is part of Scute.
  *
  * Scute is free software; you can redistribute it and/or modify it
  * under the terms of the GNU Lesser General Public License as
  * published by the Free Software Foundation; either version 2.1 of
  * the License, or (at your option) any later version.
  *
  * Scute is distributed in the hope that it will be useful, but
  * WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public
  * License along with this program; if not, see <https://gnu.org/licenses/>.
  * SPDX-License-Identifier: LGPL-2.1-or-later
  */
 
 #include <stdio.h>
 #include <stdbool.h>
 
 #include "t-support.h"
 
 
 int
 main (int argc, char *argv[])
 {
   CK_RV err;
   CK_SLOT_ID_PTR slots;
   CK_ULONG slots_count;
   unsigned int i;
 
   (void) argc;
   (void) argv;
 
   init_cryptoki ();
 
   err = C_GetSlotList (true, NULL, &slots_count);
   fail_if_err (err);
 
   if (slots_count == 0)
     {
       printf ("Skipping test because no token is present.\n");
       return 77;
     }
 
   printf ("Number of slots with tokens: %lu\n", slots_count);
   slots = malloc (sizeof (CK_SLOT_ID) * slots_count);
   if (!slots)
     fail_if_err (CKR_HOST_MEMORY);
 
   err = C_GetSlotList (true, slots, &slots_count);
   fail_if_err (err);
 
   for (i = 0; i < slots_count; i++)
     {
       CK_SESSION_HANDLE session;
       CK_OBJECT_HANDLE object;
       CK_ULONG count;
       CK_BBOOL cert_token = CK_TRUE;
       CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE;
       CK_ATTRIBUTE attr[]
 	= { { CKA_TOKEN, &cert_token, sizeof (cert_token) },
 	    { CKA_CLASS, &cert_class, sizeof (cert_class) } };
+      unsigned char issuer[] =
+        "\x30\x78\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x44\x45\x31"
+        "\x16\x30\x14\x06\x03\x55\x04\x0A\x13\x0D\x67\x31\x30\x20\x43\x6F"
+        "\x64\x65\x20\x47\x6D\x62\x48\x31\x10\x30\x0E\x06\x03\x55\x04\x0B"
+        "\x13\x07\x54\x65\x73\x74\x6C\x61\x62\x31\x1E\x30\x1C\x06\x03\x55"
+        "\x04\x03\x13\x15\x67\x31\x30\x20\x43\x6F\x64\x65\x20\x54\x45\x53"
+        "\x54\x20\x43\x41\x20\x32\x30\x31\x39\x31\x1F\x30\x1D\x06\x09\x2A"
+        "\x86\x48\x86\xF7\x0D\x01\x09\x01\x16\x10\x69\x6E\x66\x6F\x40\x67"
+        "\x31\x30\x63\x6F\x64\x65\x2E\x63\x6F\x6D";
+      CK_ATTRIBUTE attr2[]
+	= { { CKA_ISSUER, issuer, sizeof issuer - 1},
+	    { CKA_SERIAL_NUMBER, "\x02\x01\x01", 3 } };
 
       printf ("%2i. Slot ID %lu\n", i, slots[i]);
       err = C_OpenSession (slots[i], CKF_SERIAL_SESSION, NULL, NULL,
 			   &session);
       fail_if_err (err);
 
       printf ("    Session ID: %lu\n", session);
 
       err = C_FindObjectsInit (session, NULL, 0);
       fail_if_err (err);
 
       do
 	{
 	  err = C_FindObjects (session, &object, 1, &count);
 	  fail_if_err (err);
 
 	  if (count)
 	    printf ("    Object Handle: %lu\n", object);
 	}
       while (count);
 
       printf ("    Template Search: Token, Class\n");
       err = C_FindObjectsInit (session, attr, DIM (attr));
       fail_if_err (err);
 
       do
 	{
 	  err = C_FindObjects (session, &object, 1, &count);
 	  fail_if_err (err);
 
 	  if (count)
 	    printf ("    Object Handle: %lu\n", object);
 	}
       while (count);
 
       err = C_FindObjectsFinal (session);
       fail_if_err (err);
 
+      printf ("    Template Search: Issuer, Serial\n");
+      err = C_FindObjectsInit (session, attr2, DIM (attr2));
+      fail_if_err (err);
+
+      do
+	{
+	  err = C_FindObjects (session, &object, 1, &count);
+	  fail_if_err (err);
+
+	  if (count)
+	    printf ("    Object Handle: %lu\n", object);
+	}
+      while (count);
+
+      err = C_FindObjectsFinal (session);
+      fail_if_err (err);
+
       err = C_CloseSession (session);
       fail_if_err (err);
     }
 
   return 0;
 }