Result is that key label is set to "invalid subject" instead of certificate subject name.

Here is a fix diff against openssh-portable master branch



diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c
index 844aa9ff..a727d1bd 100644
--- a/ssh-pkcs11.c
+++ b/ssh-pkcs11.c
@@ -973,7 +973,7 @@ pkcs11_fetch_x509_pubkey(struct pkcs11_provider *p, CK_ULONG slotidx,
        }
 
        /* Decode DER-encoded cert subject */
-       cp = cert_attr[2].pValue;
+       cp = cert_attr[1].pValue;
        if ((x509_name = d2i_X509_NAME(NULL, &cp,
            cert_attr[1].ulValueLen)) == NULL ||
            (subject = X509_NAME_oneline(x509_name, NULL, 0)) == NULL)