@@ -1044,6 +1044,13 @@ if test "${enable_pkcs11}" = "yes"; then

 	OPTIONAL_PKCS11_HELPER_CFLAGS="${PKCS11_HELPER_CFLAGS}"

 	OPTIONAL_PKCS11_HELPER_LIBS="${PKCS11_HELPER_LIBS}"

 	AC_DEFINE([ENABLE_PKCS11], [1], [Enable PKCS11])

+	PKG_CHECK_MODULES(

+		[P11KIT],

+		[p11-kit-1],

+		[proxy_module="`$PKG_CONFIG --variable=proxy_module p11-kit-1`"

+		 AC_DEFINE_UNQUOTED([DEFAULT_PKCS11_MODULE], "${proxy_module}", [p11-kit proxy])],

+		[]

+	)

 fi

 if test "${enable_pedantic}" = "yes"; then

@@ -4355,6 +4355,16 @@ This option can be used instead of

 .B \-\-cert, \-\-key,

 and

 .B \-\-pkcs12.

+

+If p11-kit is present on the system, its

+.B p11-kit-proxy.so

+module will be loaded by default if either the

+.B \-\-pkcs11\-id

+or

+.B \-\-pkcs11\-id\-management

+options are specified without

+.B \-\-pkcs11\-provider

+being given.

 .\"*********************************************************

 .TP

 .B \-\-pkcs11-private-mode mode...

@@ -2466,6 +2466,15 @@ options_postprocess_mutate_invariant (struct options *options)

 #endif

     }

 #endif

+

+#ifdef DEFAULT_PKCS11_MODULE

+  /* If p11-kit is present on the system then load its p11-kit-proxy.so

+     by default if the user asks for PKCS#11 without otherwise specifying

+     the module to use. */

+  if (!options->pkcs11_providers[0] &&

+      (options->pkcs11_id || options->pkcs11_id_management))

+    options->pkcs11_providers[0] = DEFAULT_PKCS11_MODULE;

+#endif

 }

 static void