Mark up strings for translation

ticket: 6918

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24961 dc483132-0cff-0310-8789-dd5450dbe970

94 files changed, 2205 insertions, 1999 deletions

diff --git a/src/clients/kdestroy/kdestroy.c b/src/clients/kdestroy/kdestroy.c
index 7f4469acf7..fe5ecacf6b 100644
--- a/src/clients/kdestroy/kdestroy.c
+++ b/src/clients/kdestroy/kdestroy.c
@@ -24,7 +24,7 @@
  * or implied warranty.
  */
 
-#include "autoconf.h"
+#include "k5-platform.h"
 #include <krb5.h>
 #include <com_err.h>
 #include <string.h>
@@ -55,9 +55,9 @@ static void usage()
 {
 #define KRB_AVAIL_STRING(x) ((x)?"available":"not available")
 
-    fprintf(stderr, "Usage: %s [-q] [-c cache_name]\n", progname);
-    fprintf(stderr, "\t-q quiet mode\n");
-    fprintf(stderr, "\t-c specify name of credentials cache\n");
+    fprintf(stderr, _("Usage: %s [-q] [-c cache_name]\n"), progname);
+    fprintf(stderr, _("\t-q quiet mode\n"));
+    fprintf(stderr, _("\t-c specify name of credentials cache\n"));
     exit(2);
 }
 
@@ -84,14 +84,14 @@ main(argc, argv)
             break;
         case 'c':
             if (cache_name) {
-                fprintf(stderr, "Only one -c option allowed\n");
+                fprintf(stderr, _("Only one -c option allowed\n"));
                 errflg++;
             } else {
                 cache_name = optarg;
             }
             break;
         case '4':
-            fprintf(stderr, "Kerberos 4 is no longer supported\n");
+            fprintf(stderr, _("Kerberos 4 is no longer supported\n"));
             exit(3);
             break;
         case '5':
@@ -112,32 +112,32 @@ main(argc, argv)
 
     retval = krb5_init_context(&kcontext);
     if (retval) {
-        com_err(progname, retval, "while initializing krb5");
+        com_err(progname, retval, _("while initializing krb5"));
         exit(1);
     }
 
     if (cache_name) {
         code = krb5_cc_resolve (kcontext, cache_name, &cache);
         if (code != 0) {
-            com_err (progname, code, "while resolving %s", cache_name);
+            com_err(progname, code, _("while resolving %s"), cache_name);
             exit(1);
         }
     } else {
         code = krb5_cc_default(kcontext, &cache);
         if (code) {
-            com_err(progname, code, "while getting default ccache");
+            com_err(progname, code, _("while getting default ccache"));
             exit(1);
         }
     }
 
     code = krb5_cc_destroy (kcontext, cache);
     if (code != 0) {
-        com_err (progname, code, "while destroying cache");
+        com_err (progname, code, _("while destroying cache"));
         if (code != KRB5_FCC_NOFILE) {
             if (quiet)
-                fprintf(stderr, "Ticket cache NOT destroyed!\n");
+                fprintf(stderr, _("Ticket cache NOT destroyed!\n"));
             else {
-                fprintf(stderr, "Ticket cache %cNOT%c destroyed!\n",
+                fprintf(stderr, _("Ticket cache %cNOT%c destroyed!\n"),
                         BELL_CHAR, BELL_CHAR);
             }
             errflg = 1;
diff --git a/src/clients/kinit/kinit.c b/src/clients/kinit/kinit.c
index 292d6c3d18..682dc64704 100644
--- a/src/clients/kinit/kinit.c
+++ b/src/clients/kinit/kinit.c
@@ -205,27 +205,27 @@ usage()
             progname);
 
     fprintf(stderr, "    options:");
-    fprintf(stderr, "\t-V verbose\n");
-    fprintf(stderr, "\t-l lifetime\n");
-    fprintf(stderr, "\t-s start time\n");
-    fprintf(stderr, "\t-r renewable lifetime\n");
-    fprintf(stderr, "\t-f forwardable\n");
-    fprintf(stderr, "\t-F not forwardable\n");
-    fprintf(stderr, "\t-p proxiable\n");
-    fprintf(stderr, "\t-P not proxiable\n");
-    fprintf(stderr, "\t-n anonymous\n");
-    fprintf(stderr, "\t-a include addresses\n");
-    fprintf(stderr, "\t-A do not include addresses\n");
-    fprintf(stderr, "\t-v validate\n");
-    fprintf(stderr, "\t-R renew\n");
-    fprintf(stderr, "\t-C canonicalize\n");
-    fprintf(stderr, "\t-E client is enterprise principal name\n");
-    fprintf(stderr, "\t-k use keytab\n");
-    fprintf(stderr, "\t-t filename of keytab to use\n");
-    fprintf(stderr, "\t-c Kerberos 5 cache name\n");
-    fprintf(stderr, "\t-S service\n");
-    fprintf(stderr, "\t-T armor credential cache\n");
-    fprintf(stderr, "\t-X <attribute>[=<value>]\n");
+    fprintf(stderr, _("\t-V verbose\n"));
+    fprintf(stderr, _("\t-l lifetime\n"));
+    fprintf(stderr, _("\t-s start time\n"));
+    fprintf(stderr, _("\t-r renewable lifetime\n"));
+    fprintf(stderr, _("\t-f forwardable\n"));
+    fprintf(stderr, _("\t-F not forwardable\n"));
+    fprintf(stderr, _("\t-p proxiable\n"));
+    fprintf(stderr, _("\t-P not proxiable\n"));
+    fprintf(stderr, _("\t-n anonymous\n"));
+    fprintf(stderr, _("\t-a include addresses\n"));
+    fprintf(stderr, _("\t-A do not include addresses\n"));
+    fprintf(stderr, _("\t-v validate\n"));
+    fprintf(stderr, _("\t-R renew\n"));
+    fprintf(stderr, _("\t-C canonicalize\n"));
+    fprintf(stderr, _("\t-E client is enterprise principal name\n"));
+    fprintf(stderr, _("\t-k use keytab\n"));
+    fprintf(stderr, _("\t-t filename of keytab to use\n"));
+    fprintf(stderr, _("\t-c Kerberos 5 cache name\n"));
+    fprintf(stderr, _("\t-S service\n"));
+    fprintf(stderr, _("\t-T armor credential cache\n"));
+    fprintf(stderr, _("\t-X <attribute>[=<value>]\n"));
     exit(2);
 }
 
@@ -292,7 +292,7 @@ parse_options(argc, argv, opts)
             /* Lifetime */
             code = krb5_string_to_deltat(optarg, &opts->lifetime);
             if (code != 0 || opts->lifetime == 0) {
-                fprintf(stderr, "Bad lifetime value %s\n", optarg);
+                fprintf(stderr, _("Bad lifetime value %s\n"), optarg);
                 errflg++;
             }
             break;
@@ -300,7 +300,7 @@ parse_options(argc, argv, opts)
             /* Renewable Time */
             code = krb5_string_to_deltat(optarg, &opts->rlife);
             if (code != 0 || opts->rlife == 0) {
-                fprintf(stderr, "Bad lifetime value %s\n", optarg);
+                fprintf(stderr, _("Bad lifetime value %s\n"), optarg);
                 errflg++;
             }
             break;
@@ -332,7 +332,7 @@ parse_options(argc, argv, opts)
 
                 code = krb5_string_to_timestamp(optarg, &abs_starttime);
                 if (code != 0 || abs_starttime == 0) {
-                    fprintf(stderr, "Bad start time value %s\n", optarg);
+                    fprintf(stderr, _("Bad start time value %s\n"), optarg);
                     errflg++;
                 } else {
                     opts->starttime = abs_starttime - time(0);
@@ -348,7 +348,7 @@ parse_options(argc, argv, opts)
         case 't':
             if (opts->keytab_name)
             {
-                fprintf(stderr, "Only one -t option allowed.\n");
+                fprintf(stderr, _("Only one -t option allowed.\n"));
                 errflg++;
             } else {
                 opts->keytab_name = optarg;
@@ -356,7 +356,7 @@ parse_options(argc, argv, opts)
             break;
         case 'T':
             if (opts->armor_ccache) {
-                fprintf(stderr, "Only one armor_ccache\n");
+                fprintf(stderr, _("Only one armor_ccache\n"));
                 errflg++;
             } else opts->armor_ccache = optarg;
             break;
@@ -369,7 +369,7 @@ parse_options(argc, argv, opts)
         case 'c':
             if (opts->k5_cache_name)
             {
-                fprintf(stderr, "Only one -c option allowed\n");
+                fprintf(stderr, _("Only one -c option allowed\n"));
                 errflg++;
             } else {
                 opts->k5_cache_name = optarg;
@@ -379,7 +379,7 @@ parse_options(argc, argv, opts)
             code = add_preauth_opt(opts, optarg);
             if (code)
             {
-                com_err(progname, code, "while adding preauth option");
+                com_err(progname, code, _("while adding preauth option"));
                 errflg++;
             }
             break;
@@ -390,7 +390,7 @@ parse_options(argc, argv, opts)
             opts->enterprise = 1;
             break;
         case '4':
-            fprintf(stderr, "Kerberos 4 is no longer supported\n");
+            fprintf(stderr, _("Kerberos 4 is no longer supported\n"));
             exit(3);
             break;
         case '5':
@@ -403,22 +403,22 @@ parse_options(argc, argv, opts)
 
     if (opts->forwardable && opts->not_forwardable)
     {
-        fprintf(stderr, "Only one of -f and -F allowed\n");
+        fprintf(stderr, _("Only one of -f and -F allowed\n"));
         errflg++;
     }
     if (opts->proxiable && opts->not_proxiable)
     {
-        fprintf(stderr, "Only one of -p and -P allowed\n");
+        fprintf(stderr, _("Only one of -p and -P allowed\n"));
         errflg++;
     }
     if (opts->addresses && opts->no_addresses)
     {
-        fprintf(stderr, "Only one of -a and -A allowed\n");
+        fprintf(stderr, _("Only one of -a and -A allowed\n"));
         errflg++;
     }
 
     if (argc - optind > 1) {
-        fprintf(stderr, "Extra arguments (starting with \"%s\").\n",
+        fprintf(stderr, _("Extra arguments (starting with \"%s\").\n"),
                 argv[optind+1]);
         errflg++;
     }
@@ -441,7 +441,7 @@ k5_begin(opts, k5)
 
     code = krb5_init_context(&k5->ctx);
     if (code) {
-        com_err(progname, code, "while initializing Kerberos 5 library");
+        com_err(progname, code, _("while initializing Kerberos 5 library"));
         return 0;
     }
     errctx = k5->ctx;
@@ -449,23 +449,23 @@ k5_begin(opts, k5)
     {
         code = krb5_cc_resolve(k5->ctx, opts->k5_cache_name, &k5->cc);
         if (code != 0) {
-            com_err(progname, code, "resolving ccache %s",
+            com_err(progname, code, _("resolving ccache %s"),
                     opts->k5_cache_name);
             return 0;
         }
         if (opts->verbose) {
-            fprintf(stderr, "Using specified cache: %s\n",
+            fprintf(stderr, _("Using specified cache: %s\n"),
                     opts->k5_cache_name);
         }
     }
     else
     {
         if ((code = krb5_cc_default(k5->ctx, &k5->cc))) {
-            com_err(progname, code, "while getting default ccache");
+            com_err(progname, code, _("while getting default ccache"));
             return 0;
         }
         if (opts->verbose) {
-            fprintf(stderr, "Using default cache: %s\n",
+            fprintf(stderr, _("Using default cache: %s\n"),
                     krb5_cc_get_name(k5->ctx, k5->cc));
         }
     }
@@ -475,7 +475,7 @@ k5_begin(opts, k5)
         /* Use specified name */
         if ((code = krb5_parse_name_flags(k5->ctx, opts->principal_name,
                                           flags, &k5->me))) {
-            com_err(progname, code, "when parsing name %s",
+            com_err(progname, code, _("when parsing name %s"),
                     opts->principal_name);
             return 0;
         }
@@ -487,7 +487,7 @@ k5_begin(opts, k5)
             char *defrealm;
             code = krb5_get_default_realm(k5->ctx, &defrealm);
             if (code) {
-                com_err(progname, code, "while getting default realm");
+                com_err(progname, code, _("while getting default realm"));
                 return 0;
             }
             code = krb5_build_principal_ext(k5->ctx, &k5->me,
@@ -499,7 +499,7 @@ k5_begin(opts, k5)
                                             0);
             krb5_free_default_realm(k5->ctx, defrealm);
             if (code) {
-                com_err(progname, code, "while building principal");
+                com_err(progname, code, _("while building principal"));
                 return 0;
             }
         } else {
@@ -509,17 +509,17 @@ k5_begin(opts, k5)
                                                KRB5_NT_SRV_HST, &k5->me);
                 if (code) {
                     com_err(progname, code,
-                            "when creating default server principal name");
+                            _("when creating default server principal name"));
                     return 0;
                 }
                 if (k5->me->realm.data[0] == 0) {
                     code = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
                     if (code == 0) {
                         com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
-                                "(principal %s)", k5->name);
+                                _("(principal %s)"), k5->name);
                     } else {
                         com_err(progname, KRB5_ERR_HOST_REALM_UNKNOWN,
-                                "for local services");
+                                _("for local services"));
                     }
                     return 0;
                 }
@@ -530,12 +530,12 @@ k5_begin(opts, k5)
                 if (code) {
                     char *name = get_name_from_os();
                     if (!name) {
-                        fprintf(stderr, "Unable to identify user\n");
+                        fprintf(stderr, _("Unable to identify user\n"));
                         return 0;
                     }
                     if ((code = krb5_parse_name_flags(k5->ctx, name,
                                                       flags, &k5->me))) {
-                        com_err(progname, code, "when parsing name %s",
+                        com_err(progname, code, _("when parsing name %s"),
                                 name);
                         return 0;
                     }
@@ -546,11 +546,11 @@ k5_begin(opts, k5)
 
     code = krb5_unparse_name(k5->ctx, k5->me, &k5->name);
     if (code) {
-        com_err(progname, code, "when unparsing name");
+        com_err(progname, code, _("when unparsing name"));
         return 0;
     }
     if (opts->verbose)
-        fprintf(stderr, "Using principal: %s\n", k5->name);
+        fprintf(stderr, _("Using principal: %s\n"), k5->name);
 
     opts->principal_name = k5->name;
 
@@ -633,7 +633,7 @@ k5_kinit(opts, k5)
         krb5_address **addresses = NULL;
         code = krb5_os_localaddr(k5->ctx, &addresses);
         if (code != 0) {
-            com_err(progname, code, "getting local addresses");
+            com_err(progname, code, _("getting local addresses"));
             goto cleanup;
         }
         krb5_get_init_creds_opt_set_address_list(options, addresses);
@@ -652,7 +652,7 @@ k5_kinit(opts, k5)
                                   krb5_princ_realm(k5->ctx, k5->me)->data);
             if (code != 0) {
                 com_err(progname, code,
-                        "while setting up KDB keytab for realm %s",
+                        _("while setting up KDB keytab for realm %s"),
                         krb5_princ_realm(k5->ctx, k5->me)->data);
                 goto cleanup;
             }
@@ -661,12 +661,12 @@ k5_kinit(opts, k5)
 
         code = krb5_kt_resolve(k5->ctx, opts->keytab_name, &keytab);
         if (code != 0) {
-            com_err(progname, code, "resolving keytab %s",
+            com_err(progname, code, _("resolving keytab %s"),
                     opts->keytab_name);
             goto cleanup;
         }
         if (opts->verbose)
-            fprintf(stderr, "Using keytab: %s\n", opts->keytab_name);
+            fprintf(stderr, _("Using keytab: %s\n"), opts->keytab_name);
     }
 
     for (i = 0; i < opts->num_pa_opts; i++) {
@@ -674,12 +674,12 @@ k5_kinit(opts, k5)
                                               opts->pa_opts[i].attr,
                                               opts->pa_opts[i].value);
         if (code != 0) {
-            com_err(progname, code, "while setting '%s'='%s'",
+            com_err(progname, code, _("while setting '%s'='%s'"),
                     opts->pa_opts[i].attr, opts->pa_opts[i].value);
             goto cleanup;
         }
         if (opts->verbose) {
-            fprintf(stderr, "PA Option %s = %s\n", opts->pa_opts[i].attr,
+            fprintf(stderr, _("PA Option %s = %s\n"), opts->pa_opts[i].attr,
                     opts->pa_opts[i].value);
         }
     }
@@ -717,21 +717,21 @@ k5_kinit(opts, k5)
         switch (opts->action) {
         case INIT_PW:
         case INIT_KT:
-            doing = "getting initial credentials";
+            doing = _("getting initial credentials");
             break;
         case VALIDATE:
-            doing = "validating credentials";
+            doing = _("validating credentials");
             break;
         case RENEW:
-            doing = "renewing credentials";
+            doing = _("renewing credentials");
             break;
         }
 
         if (code == KRB5KRB_AP_ERR_BAD_INTEGRITY)
-            fprintf(stderr, "%s: Password incorrect while %s\n", progname,
+            fprintf(stderr, _("%s: Password incorrect while %s\n"), progname,
                     doing);
         else
-            com_err(progname, code, "while %s", doing);
+            com_err(progname, code, _("while %s"), doing);
         goto cleanup;
     }
 
@@ -739,20 +739,20 @@ k5_kinit(opts, k5)
         code = krb5_cc_initialize(k5->ctx, k5->cc, opts->canonicalize ?
                                   my_creds.client : k5->me);
         if (code) {
-            com_err(progname, code, "when initializing cache %s",
+            com_err(progname, code, _("when initializing cache %s"),
                     opts->k5_cache_name?opts->k5_cache_name:"");
             goto cleanup;
         }
         if (opts->verbose)
-            fprintf(stderr, "Initialized cache\n");
+            fprintf(stderr, _("Initialized cache\n"));
 
         code = krb5_cc_store_cred(k5->ctx, k5->cc, &my_creds);
         if (code) {
-            com_err(progname, code, "while storing credentials");
+            com_err(progname, code, _("while storing credentials"));
             goto cleanup;
         }
         if (opts->verbose)
-            fprintf(stderr, "Stored credentials\n");
+            fprintf(stderr, _("Stored credentials\n"));
     }
     notix = 0;
 
@@ -805,7 +805,7 @@ main(argc, argv)
         authed_k5 = k5_kinit(&opts, &k5);
 
     if (authed_k5 && opts.verbose)
-        fprintf(stderr, "Authenticated to Kerberos v5\n");
+        fprintf(stderr, _("Authenticated to Kerberos v5\n"));
 
     k5_end(&k5);
 
diff --git a/src/clients/klist/klist.c b/src/clients/klist/klist.c
index 3d34aedd8a..1ecc5f8d81 100644
--- a/src/clients/klist/klist.c
+++ b/src/clients/klist/klist.c
@@ -79,22 +79,24 @@ static void usage()
 {
 #define KRB_AVAIL_STRING(x) ((x)?"available":"not available")
 
-    fprintf(stderr, "Usage: %s [-e] [-V] [[-c] [-d] [-f] [-s] [-a [-n]]] %s",
-            progname, "[-k [-t] [-K]] [name]\n");
-    fprintf(stderr, "\t-c specifies credentials cache\n");
-    fprintf(stderr, "\t-k specifies keytab\n");
-    fprintf(stderr, "\t   (Default is credentials cache)\n");
-    fprintf(stderr, "\t-e shows the encryption type\n");
-    fprintf(stderr, "\t-V shows the Kerberos version and exits\n");
-    fprintf(stderr, "\toptions for credential caches:\n");
-    fprintf(stderr, "\t\t-d shows the submitted authorization data types\n");
-    fprintf(stderr, "\t\t-f shows credentials flags\n");
-    fprintf(stderr, "\t\t-s sets exit status based on valid tgt existence\n");
-    fprintf(stderr, "\t\t-a displays the address list\n");
-    fprintf(stderr, "\t\t\t-n do not reverse-resolve\n");
-    fprintf(stderr, "\toptions for keytabs:\n");
-    fprintf(stderr, "\t\t-t shows keytab entry timestamps\n");
-    fprintf(stderr, "\t\t-K shows keytab entry DES keys\n");
+    fprintf(stderr, _("Usage: %s [-e] [-V] [[-c] [-d] [-f] [-s] [-a [-n]]] "
+                      "[-k [-t] [-K]] [name]\n"), progname);
+    fprintf(stderr, _("\t-c specifies credentials cache\n"));
+    fprintf(stderr, _("\t-k specifies keytab\n"));
+    fprintf(stderr, _("\t   (Default is credentials cache)\n"));
+    fprintf(stderr, _("\t-e shows the encryption type\n"));
+    fprintf(stderr, _("\t-V shows the Kerberos version and exits\n"));
+    fprintf(stderr, _("\toptions for credential caches:\n"));
+    fprintf(stderr, _("\t\t-d shows the submitted authorization data "
+                      "types\n"));
+    fprintf(stderr, _("\t\t-f shows credentials flags\n"));
+    fprintf(stderr, _("\t\t-s sets exit status based on valid tgt "
+                      "existence\n"));
+    fprintf(stderr, _("\t\t-a displays the address list\n"));
+    fprintf(stderr, _("\t\t\t-n do not reverse-resolve\n"));
+    fprintf(stderr, _("\toptions for keytabs:\n"));
+    fprintf(stderr, _("\t\t-t shows keytab entry timestamps\n"));
+    fprintf(stderr, _("\t\t-K shows keytab entry DES keys\n"));
     exit(1);
 }
 
@@ -147,7 +149,7 @@ main(argc, argv)
             mode = KEYTAB;
             break;
         case '4':
-            fprintf(stderr, "Kerberos 4 is no longer supported\n");
+            fprintf(stderr, _("Kerberos 4 is no longer supported\n"));
             exit(3);
             break;
         case '5':
@@ -174,7 +176,7 @@ main(argc, argv)
     }
 
     if (argc - optind > 1) {
-        fprintf(stderr, "Extra arguments (starting with \"%s\").\n",
+        fprintf(stderr, _("Extra arguments (starting with \"%s\").\n"),
                 argv[optind+1]);
         usage();
     }
@@ -183,7 +185,7 @@ main(argc, argv)
 #ifdef _WIN32                   /* No access to autoconf vars; fix somehow. */
         printf("Kerberos for Windows\n");
 #else
-        printf("%s version %s\n", PACKAGE_NAME, PACKAGE_VERSION);
+        printf(_("%s version %s\n"), PACKAGE_NAME, PACKAGE_VERSION);
 #endif
         exit(0);
     }
@@ -206,7 +208,7 @@ main(argc, argv)
         krb5_error_code retval;
         retval = krb5_init_context(&kcontext);
         if (retval) {
-            com_err(progname, retval, "while initializing krb5");
+            com_err(progname, retval, _("while initializing krb5"));
             exit(1);
         }
 
@@ -231,29 +233,29 @@ void do_keytab(name)
 
     if (name == NULL) {
         if ((code = krb5_kt_default(kcontext, &kt))) {
-            com_err(progname, code, "while getting default keytab");
+            com_err(progname, code, _("while getting default keytab"));
             exit(1);
         }
     } else {
         if ((code = krb5_kt_resolve(kcontext, name, &kt))) {
-            com_err(progname, code, "while resolving keytab %s",
-                    name);
+            com_err(progname, code, _("while resolving keytab %s"), name);
             exit(1);
         }
     }
 
     if ((code = krb5_kt_get_name(kcontext, kt, buf, BUFSIZ))) {
-        com_err(progname, code, "while getting keytab name");
+        com_err(progname, code, _("while getting keytab name"));
         exit(1);
     }
 
     printf("Keytab name: %s\n", buf);
 
     if ((code = krb5_kt_start_seq_get(kcontext, kt, &cursor))) {
-        com_err(progname, code, "while starting keytab scan");
+        com_err(progname, code, _("while starting keytab scan"));
         exit(1);
     }
 
+    /* XXX Translating would disturb table alignment; skip for now. */
     if (show_time) {
         printf("KVNO Timestamp");
         fillit(stdout, timestamp_width - sizeof("Timestamp") + 2, (int) ' ');
@@ -270,7 +272,7 @@ void do_keytab(name)
 
     while ((code = krb5_kt_next_entry(kcontext, kt, &entry, &cursor)) == 0) {
         if ((code = krb5_unparse_name(kcontext, entry.principal, &pname))) {
-            com_err(progname, code, "while unparsing principal name");
+            com_err(progname, code, _("while unparsing principal name"));
             exit(1);
         }
         printf("%4d ", entry.vno);
@@ -294,11 +296,11 @@ void do_keytab(name)
         krb5_free_unparsed_name(kcontext, pname);
     }
     if (code && code != KRB5_KT_END) {
-        com_err(progname, code, "while scanning keytab");
+        com_err(progname, code, _("while scanning keytab"));
         exit(1);
     }
     if ((code = krb5_kt_end_seq_get(kcontext, kt, &cursor))) {
-        com_err(progname, code, "while ending keytab scan");
+        com_err(progname, code, _("while ending keytab scan"));
         exit(1);
     }
     exit(0);
@@ -321,13 +323,13 @@ void do_ccache(name)
     if (name == NULL) {
         if ((code = krb5_cc_default(kcontext, &cache))) {
             if (!status_only)
-                com_err(progname, code, "while getting default ccache");
+                com_err(progname, code, _("while getting default ccache"));
             exit(1);
         }
     } else {
         if ((code = krb5_cc_resolve(kcontext, name, &cache))) {
             if (!status_only)
-                com_err(progname, code, "while resolving ccache %s",
+                com_err(progname, code, _("while resolving ccache %s"),
                         name);
             exit(1);
         }
@@ -337,7 +339,7 @@ void do_ccache(name)
     if ((code = krb5_cc_set_flags(kcontext, cache, flags))) {
         if (code == KRB5_FCC_NOFILE) {
             if (!status_only) {
-                com_err(progname, code, "(ticket cache %s:%s)",
+                com_err(progname, code, _("(ticket cache %s:%s)"),
                         krb5_cc_get_type(kcontext, cache),
                         krb5_cc_get_name(kcontext, cache));
 #ifdef KRB5_KRB4_COMPAT
@@ -348,7 +350,7 @@ void do_ccache(name)
         } else {
             if (!status_only)
                 com_err(progname, code,
-                        "while setting cache flags (ticket cache %s:%s)",
+                        _("while setting cache flags (ticket cache %s:%s)"),
                         krb5_cc_get_type(kcontext, cache),
                         krb5_cc_get_name(kcontext, cache));
         }
@@ -356,18 +358,19 @@ void do_ccache(name)
     }
     if ((code = krb5_cc_get_principal(kcontext, cache, &princ))) {
         if (!status_only)
-            com_err(progname, code, "while retrieving principal name");
+            com_err(progname, code, _("while retrieving principal name"));
         exit(1);
     }
     if ((code = krb5_unparse_name(kcontext, princ, &defname))) {
         if (!status_only)
-            com_err(progname, code, "while unparsing principal name");
+            com_err(progname, code, _("while unparsing principal name"));
         exit(1);
     }
     if (!status_only) {
-        printf("Ticket cache: %s:%s\nDefault principal: %s\n\n",
+        printf(_("Ticket cache: %s:%s\nDefault principal: %s\n\n"),
                krb5_cc_get_type(kcontext, cache),
                krb5_cc_get_name(kcontext, cache), defname);
+        /* XXX Translating would disturb table alignment; skip for now. */
         fputs("Valid starting", stdout);
         fillit(stdout, timestamp_width - sizeof("Valid starting") + 3,
                (int) ' ');
@@ -378,7 +381,7 @@ void do_ccache(name)
     }
     if ((code = krb5_cc_start_seq_get(kcontext, cache, &cur))) {
         if (!status_only)
-            com_err(progname, code, "while starting to retrieve tickets");
+            com_err(progname, code, _("while starting to retrieve tickets"));
         exit(1);
     }
     while (!(code = krb5_cc_next_cred(kcontext, cache, &cur, &creds))) {
@@ -399,13 +402,13 @@ void do_ccache(name)
     if (code == KRB5_CC_END) {
         if ((code = krb5_cc_end_seq_get(kcontext, cache, &cur))) {
             if (!status_only)
-                com_err(progname, code, "while finishing ticket retrieval");
+                com_err(progname, code, _("while finishing ticket retrieval"));
             exit(1);
         }
         flags = KRB5_TC_OPENCLOSE;      /* turns on OPENCLOSE mode */
         if ((code = krb5_cc_set_flags(kcontext, cache, flags))) {
             if (!status_only)
-                com_err(progname, code, "while closing ccache");
+                com_err(progname, code, _("while closing ccache"));
             exit(1);
         }
 #ifdef KRB5_KRB4_COMPAT
@@ -415,7 +418,7 @@ void do_ccache(name)
         exit(exit_status);
     } else {
         if (!status_only)
-            com_err(progname, code, "while retrieving a ticket");
+            com_err(progname, code, _("while retrieving a ticket"));
         exit(1);
     }
 }
@@ -501,12 +504,12 @@ show_credential(cred)
 
     retval = krb5_unparse_name(kcontext, cred->client, &name);
     if (retval) {
-        com_err(progname, retval, "while unparsing client name");
+        com_err(progname, retval, _("while unparsing client name"));
         return;
     }
     retval = krb5_unparse_name(kcontext, cred->server, &sname);
     if (retval) {
-        com_err(progname, retval, "while unparsing server name");
+        com_err(progname, retval, _("while unparsing server name"));
         krb5_free_unparsed_name(kcontext, name);
         return;
     }
@@ -521,7 +524,7 @@ show_credential(cred)
     printf("%s\n", sname);
 
     if (strcmp(name, defname)) {
-        printf("\tfor client %s", name);
+        printf(_("\tfor client %s"), name);
         extra_field++;
     }
 
@@ -530,7 +533,7 @@ show_credential(cred)
             fputs("\t",stdout);
         else
             fputs(", ",stdout);
-        fputs("renew until ", stdout);
+        fputs(_("renew until "), stdout);
         printtime(cred->times.renew_till);
         extra_field += 2;
     }
@@ -547,7 +550,7 @@ show_credential(cred)
                 fputs("\t",stdout);
             else
                 fputs(", ",stdout);
-            printf("Flags: %s", flags);
+            printf(_("Flags: %s"), flags);
             extra_field++;
         }
     }
@@ -566,7 +569,7 @@ show_credential(cred)
             fputs("\t",stdout);
         else
             fputs(", ",stdout);
-        printf("Etype (skey, tkt): %s, ",
+        printf(_("Etype (skey, tkt): %s, "),
                etype_string(cred->keyblock.enctype));
         printf("%s ",
                etype_string(tkt->enc_part.enctype));
@@ -585,7 +588,7 @@ show_credential(cred)
                 fputs("\t",stdout);
             else
                 fputs(", ",stdout);
-            printf("AD types: ");
+            printf(_("AD types: "));
             for (i = 0; cred->authdata[i] != NULL; i++) {
                 if (i)
                     printf(", ");
@@ -602,11 +605,11 @@ show_credential(cred)
 
     if (show_addresses) {
         if (!cred->addresses || !cred->addresses[0]) {
-            printf("\tAddresses: (none)\n");
+            printf(_("\tAddresses: (none)\n"));
         } else {
             int i;
 
-            printf("\tAddresses: ");
+            printf(_("\tAddresses: "));
             one_addr(cred->addresses[0]);
 
             for (i=1; cred->addresses[i]; i++) {
@@ -639,8 +642,8 @@ void one_addr(a)
     case ADDRTYPE_INET:
         if (a->length != 4) {
         broken:
-            printf ("broken address (type %d length %d)",
-                    a->addrtype, a->length);
+            printf(_("broken address (type %d length %d)"),
+                   a->addrtype, a->length);
             return;
         }
         {
@@ -667,7 +670,7 @@ void one_addr(a)
         break;
 #endif
     default:
-        printf ("unknown addrtype %d", a->addrtype);
+        printf(_("unknown addrtype %d"), a->addrtype);
         return;
     }
 
@@ -676,8 +679,8 @@ void one_addr(a)
                        namebuf, sizeof (namebuf), 0, 0,
                        no_resolve ? NI_NUMERICHOST : 0U);
     if (err) {
-        printf ("unprintable address (type %d, error %d %s)", a->addrtype, err,
-                gai_strerror (err));
+        printf(_("unprintable address (type %d, error %d %s)"), a->addrtype,
+               err, gai_strerror (err));
         return;
     }
     printf ("%s", namebuf);
diff --git a/src/clients/kpasswd/kpasswd.c b/src/clients/kpasswd/kpasswd.c
index 3a50aba31e..27325cc6df 100644
--- a/src/clients/kpasswd/kpasswd.c
+++ b/src/clients/kpasswd/kpasswd.c
@@ -1,7 +1,7 @@
 /* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
 #include <stdio.h>
 #include <sys/types.h>
-#include "autoconf.h"
+#include "k5-platform.h"
 
 #ifndef _WIN32
 #include <unistd.h>
@@ -9,8 +9,8 @@
 
 #include <krb5.h>
 
-#define P1 "Enter new password"
-#define P2 "Enter it again"
+#define P1 _("Enter new password")
+#define P2 _("Enter it again")
 
 #ifdef HAVE_PWD_H
 #include <pwd.h>
@@ -25,11 +25,12 @@ void get_name_from_passwd_file(program_name, kcontext, me)
     krb5_error_code code;
     if ((pw = getpwuid(getuid()))) {
         if ((code = krb5_parse_name(kcontext, pw->pw_name, me))) {
-            com_err (program_name, code, "when parsing name %s", pw->pw_name);
+            com_err(program_name, code, _("when parsing name %s"),
+                    pw->pw_name);
             exit(1);
         }
     } else {
-        fprintf(stderr, "Unable to identify user from password file\n");
+        fprintf(stderr, _("Unable to identify user from password file\n"));
         exit(1);
     }
 }
@@ -38,7 +39,7 @@ void get_name_from_passwd_file(kcontext, me)
     krb5_context kcontext;
     krb5_principal * me;
 {
-    fprintf(stderr, "Unable to identify user\n");
+    fprintf(stderr, _("Unable to identify user\n"));
     exit(1);
 }
 #endif /* HAVE_PWD_H */
@@ -59,7 +60,7 @@ int main(int argc, char *argv[])
     krb5_data result_code_string, result_string;
 
     if (argc > 2) {
-        fprintf(stderr, "usage: %s [principal]\n", argv[0]);
+        fprintf(stderr, _("usage: %s [principal]\n"), argv[0]);
         exit(1);
     }
 
@@ -67,11 +68,11 @@ int main(int argc, char *argv[])
 
     ret = krb5_init_context(&context);
     if (ret) {
-        com_err(argv[0], ret, "initializing kerberos library");
+        com_err(argv[0], ret, _("initializing kerberos library"));
         exit(1);
     }
     if ((ret = krb5_get_init_creds_opt_alloc(context, &opts))) {
-        com_err(argv[0], ret, "allocating krb5_get_init_creds_opt");
+        com_err(argv[0], ret, _("allocating krb5_get_init_creds_opt"));
         exit(1);
     }
 
@@ -86,33 +87,33 @@ int main(int argc, char *argv[])
     */
     ret = krb5_cc_default(context, &ccache);
     if (ret != 0) {
-        com_err(argv[0], ret, "opening default ccache");
+        com_err(argv[0], ret, _("opening default ccache"));
         exit(1);
     }
     ret = krb5_cc_get_principal(context, ccache, &princ);
     if (ret != 0 && ret != KRB5_CC_NOTFOUND && ret != KRB5_FCC_NOFILE) {
-        com_err(argv[0], ret, "getting principal from ccache");
+        com_err(argv[0], ret, _("getting principal from ccache"));
         exit(1);
     } else {
         if (princ != NULL) {
             ret = krb5_get_init_creds_opt_set_fast_ccache(context, opts,
                                                           ccache);
             if (ret) {
-                com_err(argv[0], ret, "while setting FAST ccache");
+                com_err(argv[0], ret, _("while setting FAST ccache"));
                 exit(1);
             }
         }
     }
     ret = krb5_cc_close(context, ccache);
     if (ret != 0) {
-        com_err(argv[0], ret, "closing ccache");
+        com_err(argv[0], ret, _("closing ccache"));
         exit(1);
     }
     if (pname) {
         krb5_free_principal(context, princ);
         princ = NULL;
         if ((ret = krb5_parse_name(context, pname, &princ))) {
-            com_err(argv[0], ret, "parsing client name");
+            com_err(argv[0], ret, _("parsing client name"));
             exit(1);
         }
     }
@@ -129,16 +130,16 @@ int main(int argc, char *argv[])
                                             0, "kadmin/changepw", opts))) {
         if (ret == KRB5KRB_AP_ERR_BAD_INTEGRITY)
             com_err(argv[0], 0,
-                    "Password incorrect while getting initial ticket");
+                    _("Password incorrect while getting initial ticket"));
         else
-            com_err(argv[0], ret, "getting initial ticket");
+            com_err(argv[0], ret, _("getting initial ticket"));
         krb5_get_init_creds_opt_free(context, opts);
         exit(1);
     }
 
     pwlen = sizeof(pw);
     if ((ret = krb5_read_password(context, P1, P2, pw, &pwlen))) {
-        com_err(argv[0], ret, "while reading password");
+        com_err(argv[0], ret, _("while reading password"));
         krb5_get_init_creds_opt_free(context, opts);
         exit(1);
     }
@@ -146,7 +147,7 @@ int main(int argc, char *argv[])
     if ((ret = krb5_change_password(context, &creds, pw,
                                     &result_code, &result_code_string,
                                     &result_string))) {
-        com_err(argv[0], ret, "changing password");
+        com_err(argv[0], ret, _("changing password"));
         krb5_get_init_creds_opt_free(context, opts);
         exit(1);
     }
@@ -167,6 +168,6 @@ int main(int argc, char *argv[])
         free(result_code_string.data);
     krb5_get_init_creds_opt_free(context, opts);
 
-    printf("Password changed.\n");
+    printf(_("Password changed.\n"));
     exit(0);
 }
diff --git a/src/clients/ksu/authorization.c b/src/clients/ksu/authorization.c
index fcc5ca99d9..f1cc8acd10 100644
--- a/src/clients/ksu/authorization.c
+++ b/src/clients/ksu/authorization.c
@@ -366,13 +366,17 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err)
     }else{
         /* must be either full path or just the cmd name */
         if (strchr(fcmd, '/')){
-            asprintf(&err,"Error: bad entry - %s in %s file, must be either full path or just the cmd name\n", fcmd, KRB5_USERS_NAME);
+            asprintf(&err, _("Error: bad entry - %s in %s file, must be "
+                             "either full path or just the cmd name\n"),
+                     fcmd, KRB5_USERS_NAME);
             *out_err = err;
             return FALSE;
         }
 
 #ifndef CMD_PATH
-        asprintf(&err,"Error: bad entry - %s in %s file, since %s is just the cmd name, CMD_PATH must be defined \n", fcmd, KRB5_USERS_NAME, fcmd);
+        asprintf(&err, _("Error: bad entry - %s in %s file, since %s is just "
+                         "the cmd name, CMD_PATH must be defined \n"),
+                 fcmd, KRB5_USERS_NAME, fcmd);
         *out_err = err;
         return FALSE;
 #else
@@ -385,7 +389,8 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err)
         tc = get_first_token (path_ptr, &lp);
 
         if (! tc){
-            asprintf(&err,"Error: bad entry - %s in %s file, CMD_PATH contains no paths \n",  fcmd, KRB5_USERS_NAME);
+            asprintf(&err, _("Error: bad entry - %s in %s file, CMD_PATH "
+                             "contains no paths \n"), fcmd, KRB5_USERS_NAME);
             *out_err = err;
             return FALSE;
         }
@@ -393,7 +398,8 @@ krb5_boolean fcmd_resolve(fcmd, out_fcmd, out_err)
         i=0;
         do{
             if (*tc != '/'){  /* must be full path */
-                asprintf(&err,"Error: bad path %s in CMD_PATH for %s must start with '/' \n",tc, KRB5_USERS_NAME );
+                asprintf(&err, _("Error: bad path %s in CMD_PATH for %s must "
+                                 "start with '/' \n"), tc, KRB5_USERS_NAME );
                 *out_err = err;
                 return FALSE;
             }
@@ -508,7 +514,7 @@ krb5_boolean find_first_cmd_that_exists(fcmd_arr, cmd_out, err_out)
 
     if (retbool == FALSE ){
         krb5int_buf_init_dynamic(&buf);
-        krb5int_buf_add(&buf, "Error: not found -> ");
+        krb5int_buf_add(&buf, _("Error: not found -> "));
         for(j= 0; j < i; j ++)
             krb5int_buf_add_fmt(&buf, " %s ", fcmd_arr[j]);
         krb5int_buf_add(&buf, "\n");
@@ -714,9 +720,8 @@ void init_auth_names(pw_dir)
                   pw_dir, sep, KRB5_USERS_NAME);
     if (SNPRINTF_OVERFLOW(r1, sizeof(k5login_path)) ||
         SNPRINTF_OVERFLOW(r2, sizeof(k5users_path))) {
-        fprintf (stderr,
-                 "home directory name `%s' too long, can't search for .k5login\n",
-                 pw_dir);
+        fprintf(stderr, _("home directory name `%s' too long, can't search "
+                          "for .k5login\n"), pw_dir);
         exit (1);
     }
 }
diff --git a/src/clients/ksu/ccache.c b/src/clients/ksu/ccache.c
index 5192623512..9916c75f30 100644
--- a/src/clients/ksu/ccache.c
+++ b/src/clients/ksu/ccache.c
@@ -70,8 +70,7 @@ krb5_error_code krb5_ccache_copy (context, cc_def, cc_other_tag,
     cc_other = (krb5_ccache *)  xcalloc(1, sizeof (krb5_ccache));
 
     if ((retval = krb5_cc_resolve(context, cc_other_tag, cc_other))){
-        com_err (prog_name, retval, "resolving ccache %s",
-                 cc_other_tag);
+        com_err(prog_name, retval, _("resolving ccache %s"), cc_other_tag);
         return retval;
     }
 
@@ -382,7 +381,7 @@ krb5_get_login_princ(luser, princ_list)
     }
     result = snprintf(pbuf, sizeof(pbuf), "%s/.k5login", pwd->pw_dir);
     if (SNPRINTF_OVERFLOW(result, sizeof(pbuf))) {
-        fprintf (stderr, "home directory path for %s too long\n", luser);
+        fprintf(stderr, _("home directory path for %s too long\n"), luser);
         exit (1);
     }
 
@@ -464,22 +463,22 @@ show_credential(context, cred, cc)
 
     retval = krb5_unparse_name(context, cred->client, &name);
     if (retval) {
-        com_err(prog_name, retval, "while unparsing client name");
+        com_err(prog_name, retval, _("while unparsing client name"));
         return;
     }
     retval = krb5_unparse_name(context, cred->server, &sname);
     if (retval) {
-        com_err(prog_name, retval, "while unparsing server name");
+        com_err(prog_name, retval, _("while unparsing server name"));
         free(name);
         return;
     }
 
     if ((retval = krb5_cc_get_principal(context, cc, &princ))) {
-        com_err(prog_name, retval, "while retrieving principal name");
+        com_err(prog_name, retval, _("while retrieving principal name"));
         return;
     }
     if ((retval = krb5_unparse_name(context, princ, &defname))) {
-        com_err(prog_name, retval, "while unparsing principal name");
+        com_err(prog_name, retval, _("while unparsing principal name"));
         return;
     }
 
@@ -494,7 +493,7 @@ show_credential(context, cred, cc)
     printf("%s\n", sname);
 
     if (strcmp(name, defname)) {
-        printf("\tfor client %s", name);
+        printf(_("\tfor client %s"), name);
         first = 0;
     }
 
@@ -503,7 +502,7 @@ show_credential(context, cred, cc)
             fputs("\t",stdout);
         else
             fputs(", ",stdout);
-        fputs("renew until ", stdout);
+        fputs(_("renew until "), stdout);
         printtime(cred->times.renew_till);
     }
     if (show_flags) {
@@ -513,7 +512,7 @@ show_credential(context, cred, cc)
                 fputs("\t",stdout);
             else
                 fputs(", ",stdout);
-            printf("Flags: %s", flags);
+            printf(_("Flags: %s"), flags);
             first = 0;
         }
     }
@@ -660,8 +659,7 @@ krb5_error_code krb5_ccache_copy_restricted (context, cc_def, cc_other_tag,
     cc_other = (krb5_ccache *)  xcalloc(1, sizeof (krb5_ccache));
 
     if ((retval = krb5_cc_resolve(context, cc_other_tag, cc_other))){
-        com_err (prog_name, retval, "resolving ccache %s",
-                 cc_other_tag);
+        com_err(prog_name, retval, _("resolving ccache %s"), cc_other_tag);
         return retval;
     }
 
diff --git a/src/clients/ksu/krb_auth_su.c b/src/clients/ksu/krb_auth_su.c
index b919c39b20..eb597aa268 100644
--- a/src/clients/ksu/krb_auth_su.c
+++ b/src/clients/ksu/krb_auth_su.c
@@ -63,7 +63,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
 
 
     if ((retval= krb5_copy_principal(context,  client_pname, &client))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
@@ -75,7 +75,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
     if ((retval = krb5_sname_to_principal(context, hostname, NULL,
                                           KRB5_NT_SRV_HST, &server))){
         com_err(prog_name, retval,
-                "while creating server %s principal name", hostname);
+                _("while creating server %s principal name"), hostname);
         krb5_free_principal(context, client);
         return (FALSE) ;
     }
@@ -100,14 +100,14 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
     /* check to see if the local tgt is in the cache */
 
     if ((retval= krb5_copy_principal(context,  client, &tgtq.client))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
     if ((retval = ksu_tgtname(context,  krb5_princ_realm(context, client),
                               krb5_princ_realm(context, client),
                               &tgtq.server))){
-        com_err(prog_name, retval, "while creating tgt for local realm");
+        com_err(prog_name, retval, _("while creating tgt for local realm"));
         krb5_free_principal(context, client);
         krb5_free_principal(context, server);
         return (FALSE) ;
@@ -123,8 +123,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
     if (retval){
         if ((retval != KRB5_CC_NOTFOUND) &&
             (retval != KRB5KRB_AP_ERR_TKT_EXPIRED)){
-            com_err(prog_name, retval,
-                    "while retrieving creds from cache");
+            com_err(prog_name, retval, _("while retrieving creds from cache"));
             return (FALSE) ;
         }
     } else{
@@ -135,13 +134,15 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
 
 #ifdef GET_TGT_VIA_PASSWD
         if (krb5_seteuid(0)||krb5_seteuid(target_uid)) {
-            com_err("ksu", errno, "while switching to target uid");
+            com_err("ksu", errno, _("while switching to target uid"));
             return FALSE;
         }
 
 
-        fprintf(stderr,"WARNING: Your password may be exposed if you enter it here and are logged \n");
-        fprintf(stderr,"         in remotely using an unsecure (non-encrypted) channel. \n");
+        fprintf(stderr, _("WARNING: Your password may be exposed if you enter "
+                          "it here and are logged \n"));
+        fprintf(stderr, _("         in remotely using an unsecure "
+                          "(non-encrypted) channel. \n"));
 
         /*get the ticket granting ticket, via passwd(promt for passwd)*/
         if (krb5_get_tkt_via_passwd (context, &cc, client, tgtq.server,
@@ -152,13 +153,14 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
         }
         *path_passwd = 1;
         if (krb5_seteuid(0)) {
-            com_err("ksu", errno, "while reclaiming root uid");
+            com_err("ksu", errno, _("while reclaiming root uid"));
             return FALSE;
         }
 
 #else
         plain_dump_principal (context, client);
-        fprintf(stderr,"does not have any appropriate tickets in the cache.\n");
+        fprintf(stderr,
+                _("does not have any appropriate tickets in the cache.\n"));
         return FALSE;
 
 #endif /* GET_TGT_VIA_PASSWD */
@@ -166,18 +168,18 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
     }
 
     if ((retval= krb5_copy_principal(context, client, &in_creds.client))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
     if ((retval= krb5_copy_principal(context, server, &in_creds.server))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
     if ((retval = krb5_get_credentials(context, 0, cc, &in_creds,
                                        &out_creds))){
-        com_err(prog_name, retval, "while getting credentials from kdc");
+        com_err(prog_name, retval, _("while getting credentials from kdc"));
         return (FALSE);
     }
 
@@ -194,7 +196,7 @@ krb5_boolean krb5_auth_check(context, client_pname, hostname, options,
                                     NULL /*output ccache*/,
                                     &vfy_opts);
     if (retval) {
-        com_err(prog_name, retval, "while verifying ticket for server");
+        com_err(prog_name, retval, _("while verifying ticket for server"));
         return (FALSE);
     }
 
@@ -220,12 +222,12 @@ krb5_boolean krb5_fast_auth(context, client, server, target_user, cc)
     memset(&tgt, 0, sizeof(tgt));
 
     if ((retval= krb5_copy_principal(context, client, &tgtq.client))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
     if ((retval= krb5_copy_principal(context, server, &tgtq.server))){
-        com_err(prog_name, retval,"while copying client principal");
+        com_err(prog_name, retval, _("while copying client principal"));
         return (FALSE) ;
     }
 
@@ -233,7 +235,7 @@ krb5_boolean krb5_fast_auth(context, client, server, target_user, cc)
                                         KRB5_TC_MATCH_SRV_NAMEONLY | KRB5_TC_SUPPORTED_KTYPES,
                                         &tgtq, &tgt))){
         if (auth_debug)
-            com_err(prog_name, retval,"While Retrieving credentials");
+            com_err(prog_name, retval, _("while Retrieving credentials"));
         return (FALSE) ;
 
     }
@@ -243,7 +245,7 @@ krb5_boolean krb5_fast_auth(context, client, server, target_user, cc)
                                     NULL /*output ccache*/,
                                     &vfy_opts);
     if (retval){
-        com_err(prog_name, retval, "while verifing ticket for server");
+        com_err(prog_name, retval, _("while verifying ticket for server"));
         return (FALSE);
     }
 
@@ -271,24 +273,24 @@ krb5_boolean krb5_get_tkt_via_passwd (context, ccache, client, server,
     *zero_password = FALSE;
 
     if ((code = krb5_unparse_name(context, client, &client_name))) {
-        com_err (prog_name, code, "when unparsing name");
+        com_err (prog_name, code, _("when unparsing name"));
         return (FALSE);
     }
 
     memset(&my_creds, 0, sizeof(my_creds));
 
     if ((code = krb5_copy_principal(context, client, &my_creds.client))){
-        com_err (prog_name, code, "while copying principal");
+        com_err (prog_name, code, _("while copying principal"));
         return (FALSE);
     }
 
     if ((code = krb5_copy_principal(context, server, &my_creds.server))){
-        com_err (prog_name, code, "while copying principal");
+        com_err (prog_name, code, _("while copying principal"));
         return (FALSE);
     }
 
     if ((code = krb5_timeofday(context, &now))) {
-        com_err(prog_name, code, "while getting time of day");
+        com_err(prog_name, code, _("while getting time of day"));
         return (FALSE);
     }
 
@@ -301,12 +303,12 @@ krb5_boolean krb5_get_tkt_via_passwd (context, ccache, client, server,
     } else
         my_creds.times.renew_till = 0;
 
-    result = snprintf(prompt, sizeof(prompt), "Kerberos password for %s: ",
+    result = snprintf(prompt, sizeof(prompt), _("Kerberos password for %s: "),
                       client_name);
     if (SNPRINTF_OVERFLOW(result, sizeof(prompt))) {
-        fprintf (stderr,
-                 "principal name %s too long for internal buffer space\n",
-                 client_name);
+        fprintf(stderr,
+                _("principal name %s too long for internal buffer space\n"),
+                client_name);
         return FALSE;
     }
 
@@ -314,14 +316,14 @@ krb5_boolean krb5_get_tkt_via_passwd (context, ccache, client, server,
 
     code = krb5_read_password(context, prompt, 0, password, &pwsize);
     if (code ) {
-        com_err(prog_name, code, "while reading password for '%s'\n",
+        com_err(prog_name, code, _("while reading password for '%s'\n"),
                 client_name);
         memset(password, 0, sizeof(password));
         return (FALSE);
     }
 
     if ( pwsize == 0) {
-        fprintf(stderr, "No password given\n");
+        fprintf(stderr, _("No password given\n"));
         *zero_password = TRUE;
         memset(password, 0, sizeof(password));
         return (FALSE);
@@ -335,9 +337,9 @@ krb5_boolean krb5_get_tkt_via_passwd (context, ccache, client, server,
 
     if (code) {
         if (code == KRB5KRB_AP_ERR_BAD_INTEGRITY)
-            fprintf (stderr, "%s: Password incorrect\n", prog_name);
+            fprintf(stderr, _("%s: Password incorrect\n"), prog_name);
         else
-            com_err (prog_name, code, "while getting initial credentials");
+            com_err(prog_name, code, _("while getting initial credentials"));
         return (FALSE);
     }
     return (TRUE);
@@ -353,7 +355,8 @@ void dump_principal (context, str, p)
     krb5_error_code retval;
 
     if ((retval = krb5_unparse_name(context, p, &stname))) {
-        fprintf(stderr, " %s while unparsing name\n", error_message(retval));
+        fprintf(stderr, _(" %s while unparsing name\n"),
+                error_message(retval));
     }
     fprintf(stderr, " %s: %s\n", str, stname);
 }
@@ -365,8 +368,10 @@ void plain_dump_principal (context, p)
     char * stname;
     krb5_error_code retval;
 
-    if ((retval = krb5_unparse_name(context, p, &stname)))
-        fprintf(stderr, " %s while unparsing name\n", error_message(retval));
+    if ((retval = krb5_unparse_name(context, p, &stname))) {
+        fprintf(stderr, _(" %s while unparsing name\n"),
+                error_message(retval));
+    }
     fprintf(stderr, "%s ", stname);
 }
 
diff --git a/src/clients/ksu/main.c b/src/clients/ksu/main.c
index e548f1699a..e3d2999e56 100644
--- a/src/clients/ksu/main.c
+++ b/src/clients/ksu/main.c
@@ -58,7 +58,10 @@ char * get_dir_of_file();
    ill specified arguments to commands */
 
 void usage (){
-    fprintf(stderr, "Usage: %s [target user] [-n principal] [-c source cachename] [-k] [-D] [-r time] [-pf] [-l lifetime] [-zZ] [-q] [-e command [args... ] ] [-a [args... ] ]\n", prog_name);
+    fprintf(stderr,
+            _("Usage: %s [target user] [-n principal] [-c source cachename] "
+              "[-k] [-D] [-r time] [-pf] [-l lifetime] [-zZ] [-q] "
+              "[-e command [args... ] ] [-a [args... ] ]\n"), prog_name);
 }
 
 /* for Ultrix and friends ... */
@@ -128,7 +131,7 @@ main (argc, argv)
 
     retval = krb5_init_secure_context(&ksu_context);
     if (retval) {
-        com_err(argv[0], retval, "while initializing krb5");
+        com_err(argv[0], retval, _("while initializing krb5"));
         exit(1);
     }
 
@@ -137,7 +140,9 @@ main (argc, argv)
     prog_name = argv[0];
     if (strlen (prog_name) > 50) {
         /* this many chars *after* last / ?? */
-        com_err(prog_name, 0, "program name too long - quitting to avoid triggering system logging bugs");
+        com_err(prog_name, 0,
+                _("program name too long - quitting to avoid triggering "
+                  "system logging bugs"));
         exit (1);
     }
 
@@ -162,7 +167,7 @@ main (argc, argv)
         pargc = argc -1;
 
         if ((pargv =(char **) calloc(pargc +1,sizeof(char *)))==NULL){
-            com_err(prog_name, errno, "while allocating memory");
+            com_err(prog_name, errno, _("while allocating memory"));
             exit(1);
         }
 
@@ -175,7 +180,7 @@ main (argc, argv)
     }
 
     if (krb5_seteuid (ruid)) {
-        com_err (prog_name, errno, "while setting euid to source user");
+        com_err (prog_name, errno, _("while setting euid to source user"));
         exit (1);
     }
     while(!done && ((option = getopt(pargc, pargv,"n:c:r:a:zZDfpkql:e:")) != -1)){
@@ -186,7 +191,7 @@ main (argc, argv)
                 optarg = "bad-time";
             retval = krb5_string_to_deltat(optarg, &options.rlife);
             if (retval != 0 || options.rlife == 0) {
-                fprintf(stderr, "Bad lifetime value (%s hours?)\n", optarg);
+                fprintf(stderr, _("Bad lifetime value (%s hours?)\n"), optarg);
                 errflg++;
             }
             break;
@@ -197,7 +202,7 @@ main (argc, argv)
             if (auth_debug){printf("Before get_params optind=%d\n", optind);}
 
             if ((retval = get_params( & optind, pargc, pargv, &params))){
-                com_err(prog_name, retval, "when gathering parameters");
+                com_err(prog_name, retval, _("when gathering parameters"));
                 errflg++;
             }
             if(auth_debug){ printf("After get_params optind=%d\n", optind);}
@@ -220,13 +225,13 @@ main (argc, argv)
                 optarg = "bad-time";
             retval = krb5_string_to_deltat(optarg, &options.lifetime);
             if (retval != 0 || options.lifetime == 0) {
-                fprintf(stderr, "Bad lifetime value (%s hours?)\n", optarg);
+                fprintf(stderr, _("Bad lifetime value (%s hours?)\n"), optarg);
                 errflg++;
             }
             break;
         case 'n':
             if ((retval = krb5_parse_name(ksu_context, optarg, &client))){
-                com_err(prog_name, retval, "when parsing name %s", optarg);
+                com_err(prog_name, retval, _("when parsing name %s"), optarg);
                 errflg++;
             }
 
@@ -242,7 +247,7 @@ main (argc, argv)
             some_rest_copy = 1;
             if(all_rest_copy) {
                 fprintf(stderr,
-                        "-z option is mutually exclusive with -Z.\n");
+                        _("-z option is mutually exclusive with -Z.\n"));
                 errflg++;
             }
             break;
@@ -250,7 +255,7 @@ main (argc, argv)
             all_rest_copy = 1;
             if(some_rest_copy) {
                 fprintf(stderr,
-                        "-Z option is mutually exclusive with -z.\n");
+                        _("-Z option is mutually exclusive with -z.\n"));
                 errflg++;
             }
             break;
@@ -261,20 +266,20 @@ main (argc, argv)
                     cc_source_tag_tmp = strchr(cc_source_tag, ':') + 1;
 
                     if( stat( cc_source_tag_tmp, &st_temp)){
-                        com_err (prog_name, errno,
-                                 "while looking for credentials file %s",
-                                 cc_source_tag_tmp);
+                        com_err(prog_name, errno,
+                                _("while looking for credentials file %s"),
+                                cc_source_tag_tmp);
                         exit (1);
                     }
                 }
                 else {
-                    fprintf(stderr,"malformed credential cache name %s\n",
+                    fprintf(stderr, _("malformed credential cache name %s\n"),
                             cc_source_tag);
                     errflg++;
                 }
 
             } else {
-                fprintf(stderr, "Only one -c option allowed\n");
+                fprintf(stderr, _("Only one -c option allowed\n"));
                 errflg++;
             }
             break;
@@ -282,7 +287,7 @@ main (argc, argv)
             cmd = xstrdup(optarg);
             if(auth_debug){printf("Before get_params optind=%d\n", optind);}
             if ((retval = get_params( & optind, pargc, pargv, &params))){
-                com_err(prog_name, retval, "when gathering parameters");
+                com_err(prog_name, retval, _("when gathering parameters"));
                 errflg++;
             }
             if(auth_debug){printf("After get_params optind=%d\n", optind);}
@@ -326,11 +331,11 @@ main (argc, argv)
     }
 
     if (pwd == NULL) {
-        fprintf(stderr, "ksu: who are you?\n");
+        fprintf(stderr, _("ksu: who are you?\n"));
         exit(1);
     }
     if (pwd->pw_uid != ruid) {
-        fprintf (stderr, "Your uid doesn't match your passwd entry?!\n");
+        fprintf (stderr, _("Your uid doesn't match your passwd entry?!\n"));
         exit (1);
     }
     /* Okay, now we have *some* passwd entry that matches the
@@ -347,7 +352,7 @@ main (argc, argv)
     }
 
     if ((target_pwd = getpwnam(target_user)) == NULL){
-        fprintf(stderr, "ksu: unknown login %s\n", target_user);
+        fprintf(stderr, _("ksu: unknown login %s\n"), target_user);
         exit(1);
     }
     target_uid = target_pwd->pw_uid;
@@ -368,13 +373,13 @@ main (argc, argv)
 
     /* get a handle for the cache */
     if ((retval = krb5_cc_resolve(ksu_context, cc_source_tag, &cc_source))){
-        com_err(prog_name, retval,"while getting source cache");
+        com_err(prog_name, retval, _("while getting source cache"));
         exit(1);
     }
 
     if (((retval = krb5_cc_set_flags(ksu_context,  cc_source, 0x0)) != 0)
         && (retval != KRB5_FCC_NOFILE)) {
-        com_err(prog_name, retval, "while opening ccache");
+        com_err(prog_name, retval, _("while opening ccache"));
         exit(1);
     }
     if ((retval = get_best_princ_for_target(ksu_context, source_uid,
@@ -382,7 +387,7 @@ main (argc, argv)
                                             target_user, cc_source,
                                             &options, cmd, localhostname,
                                             &client, &hp))){
-        com_err(prog_name,retval, "while selecting the best principal");
+        com_err(prog_name,retval, _("while selecting the best principal"));
         exit(1);
     }
 
@@ -390,7 +395,8 @@ main (argc, argv)
        what happened; become source.*/
     if ( geteuid() != source_uid) {
         if (krb5_seteuid(0) || krb5_seteuid(source_uid) ) {
-            com_err(prog_name, errno, "while returning to source uid after finding best principal");
+            com_err(prog_name, errno, _("while returning to source uid after "
+                                        "finding best principal"));
             exit(1);
         }
     }
@@ -409,7 +415,7 @@ main (argc, argv)
 
     if (hp){
         if (gb_err) fprintf(stderr, "%s", gb_err);
-        fprintf(stderr,"account %s: authorization failed\n",target_user);
+        fprintf(stderr, _("account %s: authorization failed\n"), target_user);
         exit(1);
     }
 
@@ -435,7 +441,7 @@ main (argc, argv)
 
     if (access(dir_of_cc_target, R_OK | W_OK )){
         fprintf(stderr,
-                "%s does not have correct permissions for %s\n",
+                _("%s does not have correct permissions for %s\n"),
                 source_user, cc_target_tag);
         exit(1);
     }
@@ -465,19 +471,16 @@ main (argc, argv)
                                                   cc_target_tag, client,
                                                   &cc_target, &stored,
                                                   target_uid))){
-            com_err (prog_name, retval,
-                     "while copying cache %s to %s",
-                     krb5_cc_get_name(ksu_context, cc_source),cc_target_tag);
+            com_err(prog_name, retval, _("while copying cache %s to %s"),
+                    krb5_cc_get_name(ksu_context, cc_source), cc_target_tag);
             exit(1);
         }
 
     } else {
         if ((retval = krb5_ccache_copy(ksu_context, cc_source, cc_target_tag,
                                        client,&cc_target, &stored, target_uid))) {
-            com_err (prog_name, retval,
-                     "while copying cache %s to %s",
-                     krb5_cc_get_name(ksu_context, cc_source),
-                     cc_target_tag);
+            com_err(prog_name, retval, _("while copying cache %s to %s"),
+                    krb5_cc_get_name(ksu_context, cc_source), cc_target_tag);
             exit(1);
         }
 
@@ -486,7 +489,7 @@ main (argc, argv)
     /* Become root for authentication*/
 
     if (krb5_seteuid(0)) {
-        com_err(prog_name, errno, "while reclaiming root uid");
+        com_err(prog_name, errno, _("while reclaiming root uid"));
         exit(1);
     }
 
@@ -498,25 +501,26 @@ main (argc, argv)
                                       krb5_princ_realm(ksu_context, client),
                                       &kdc_server))){
                 com_err(prog_name, retval,
-                        "while creating tgt for local realm");
+                        _("while creating tgt for local realm"));
                 sweep_up(ksu_context, cc_target);
                 exit(1);
             }
 
-            fprintf(stderr,"WARNING: Your password may be exposed if you enter it here and are logged\n");
-            fprintf(stderr,"         in remotely using an unsecure (non-encrypted) channel.\n");
+            fprintf(stderr, _("WARNING: Your password may be exposed if you "
+                              "enter it here and are logged\n"));
+            fprintf(stderr, _("         in remotely using an unsecure "
+                              "(non-encrypted) channel.\n"));
             if (krb5_get_tkt_via_passwd (ksu_context, &cc_target, client,
                                          kdc_server, &options,
                                          &zero_password) == FALSE){
 
                 if (zero_password == FALSE){
-                    fprintf(stderr,"Goodbye\n");
+                    fprintf(stderr, _("Goodbye\n"));
                     sweep_up(ksu_context, cc_target);
                     exit(1);
                 }
 
-                fprintf(stderr,
-                        "Could not get a tgt for ");
+                fprintf(stderr, _("Could not get a tgt for "));
                 plain_dump_principal (ksu_context, client);
                 fprintf(stderr, "\n");
 
@@ -536,9 +540,8 @@ main (argc, argv)
 
         /* if Kerberos authentication failed then exit */
         if (auth_val ==FALSE){
-            fprintf(stderr, "Authentication failed.\n");
-            syslog(LOG_WARNING,
-                   "'%s %s' authentication failed for %s%s",
+            fprintf(stderr, _("Authentication failed.\n"));
+            syslog(LOG_WARNING, "'%s %s' authentication failed for %s%s",
                    prog_name,target_user,source_user,ontty());
             sweep_up(ksu_context, cc_target);
             exit(1);
@@ -572,51 +575,51 @@ main (argc, argv)
 #endif /*0*/
 
         if ((retval = krb5_unparse_name(ksu_context, client, &client_name))) {
-            com_err (prog_name, retval, "When unparsing name");
+            com_err(prog_name, retval, _("When unparsing name"));
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
 
-        print_status("Authenticated %s\n", client_name);
+        print_status(_("Authenticated %s\n"), client_name);
         syslog(LOG_NOTICE,"'%s %s' authenticated %s for %s%s",
                prog_name,target_user,client_name,
                source_user,ontty());
 
         /* Run authorization as target.*/
         if (krb5_seteuid(target_uid)) {
-            com_err(prog_name, errno, "while switching to target for authorization check");
+            com_err(prog_name, errno, _("while switching to target for "
+                                        "authorization check"));
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
 
         if ((retval = krb5_authorization(ksu_context, client,target_user,
                                          cmd, &authorization_val, &exec_cmd))){
-            com_err(prog_name,retval,"while checking authorization");
+            com_err(prog_name,retval, _("while checking authorization"));
             krb5_seteuid(0); /*So we have some chance of sweeping up*/
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
 
         if (krb5_seteuid(0)) {
-            com_err(prog_name, errno, "while switching back from  target after authorization check");
+            com_err(prog_name, errno, _("while switching back from target "
+                                        "after authorization check"));
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
         if (authorization_val == TRUE){
 
             if (cmd) {
-                print_status(
-                    "Account %s: authorization for %s for execution of\n",
-                    target_user, client_name);
-                print_status("               %s successful\n",exec_cmd);
+                print_status(_("Account %s: authorization for %s for "
+                               "execution of\n"), target_user, client_name);
+                print_status(_("               %s successful\n"), exec_cmd);
                 syslog(LOG_NOTICE,
                        "Account %s: authorization for %s for execution of %s successful",
                        target_user, client_name, exec_cmd);
 
             }else{
-                print_status(
-                    "Account %s: authorization for %s successful\n",
-                    target_user, client_name);
+                print_status(_("Account %s: authorization for %s "
+                               "successful\n"), target_user, client_name);
                 syslog(LOG_NOTICE,
                        "Account %s: authorization for %s successful",
                        target_user, client_name);
@@ -627,16 +630,15 @@ main (argc, argv)
                     fprintf(stderr, "%s", exec_cmd );
                     syslog(LOG_WARNING, "%s",exec_cmd);
                 }
-                fprintf(stderr,
-                        "Account %s: authorization for %s for execution of %s failed\n",
+                fprintf(stderr, _("Account %s: authorization for %s for "
+                                  "execution of %s failed\n"),
                         target_user, client_name, cmd );
                 syslog(LOG_WARNING,
                        "Account %s: authorization for %s for execution of %s failed",
                        target_user, client_name, cmd );
 
             }else{
-                fprintf(stderr,
-                        "Account %s: authorization of %s failed\n",
+                fprintf(stderr, _("Account %s: authorization of %s failed\n"),
                         target_user, client_name);
                 syslog(LOG_WARNING,
                        "Account %s: authorization of %s failed",
@@ -651,7 +653,7 @@ main (argc, argv)
 
     if( some_rest_copy){
         if ((retval = krb5_ccache_filter(ksu_context, cc_target, client))){
-            com_err(prog_name,retval,"while calling cc_filter");
+            com_err(prog_name,retval, _("while calling cc_filter"));
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
@@ -659,8 +661,7 @@ main (argc, argv)
 
     if (all_rest_copy){
         if ((retval = krb5_cc_initialize(ksu_context, cc_target, client))){
-            com_err(prog_name, retval,
-                    "while erasing target cache");
+            com_err(prog_name, retval, _("while erasing target cache"));
             exit(1);
         }
 
@@ -680,7 +681,7 @@ main (argc, argv)
     /* insist that the target login uses a standard shell (root is omited) */
 
     if (!standard_shell(target_pwd->pw_shell) && source_uid) {
-        fprintf(stderr, "ksu: permission denied (shell).\n");
+        fprintf(stderr, _("ksu: permission denied (shell).\n"));
         sweep_up(ksu_context, cc_target);
         exit(1);
     }
@@ -689,20 +690,21 @@ main (argc, argv)
     if (target_pwd->pw_uid){
 
         if(set_env_var("USER", target_pwd->pw_name)){
-            fprintf(stderr,"ksu: couldn't set environment variable USER\n");
+            fprintf(stderr,
+                    _("ksu: couldn't set environment variable USER\n"));
             sweep_up(ksu_context, cc_target);
             exit(1);
         }
     }
 
     if(set_env_var( "HOME", target_pwd->pw_dir)){
-        fprintf(stderr,"ksu: couldn't set environment variable USER\n");
+        fprintf(stderr, _("ksu: couldn't set environment variable USER\n"));
         sweep_up(ksu_context, cc_target);
         exit(1);
     }
 
     if(set_env_var( "SHELL", shell)){
-        fprintf(stderr,"ksu: couldn't set environment variable USER\n");
+        fprintf(stderr, _("ksu: couldn't set environment variable SHELL\n"));
         sweep_up(ksu_context, cc_target);
         exit(1);
     }
@@ -710,7 +712,7 @@ main (argc, argv)
     /* set the cc env name to target */
 
     if(set_env_var( KRB5_ENV_CCNAME, cc_target_tag)){
-        fprintf(stderr,"ksu: couldn't set environment variable %s\n",
+        fprintf(stderr, _("ksu: couldn't set environment variable %s\n"),
                 KRB5_ENV_CCNAME);
         sweep_up(ksu_context, cc_target);
         exit(1);
@@ -725,16 +727,16 @@ main (argc, argv)
 
 
     if (initgroups(target_user, target_pwd->pw_gid)) {
-        fprintf(stderr, "ksu: initgroups failed.\n");
+        fprintf(stderr, _("ksu: initgroups failed.\n"));
         sweep_up(ksu_context, cc_target);
         exit(1);
     }
 
     if ( ! strcmp(target_user, source_user)){
-        print_status("Leaving uid as %s (%ld)\n",
+        print_status(_("Leaving uid as %s (%ld)\n"),
                      target_user, (long) target_pwd->pw_uid);
     }else{
-        print_status("Changing uid to %s (%ld)\n",
+        print_status(_("Changing uid to %s (%ld)\n"),
                      target_user, (long) target_pwd->pw_uid);
     }
 
@@ -759,7 +761,7 @@ main (argc, argv)
 
     if (access( cc_target_tag_tmp, R_OK | W_OK )){
         com_err(prog_name, errno,
-                "%s does not have correct permissions for %s, %s aborted",
+                _("%s does not have correct permissions for %s, %s aborted"),
                 target_user, cc_target_tag_tmp, prog_name);
         exit(1);
     }
@@ -773,8 +775,8 @@ main (argc, argv)
         }
 
         if( !exec_cmd){
-            fprintf(stderr,
-                    "Internal error: command %s did not get resolved\n",cmd);
+            fprintf(stderr, _("Internal error: command %s did not get "
+                              "resolved\n"), cmd);
             exit(1);
         }
 
@@ -790,8 +792,7 @@ main (argc, argv)
 
     if( keep_target_cache ) {
         execv(params[0], params);
-        com_err(prog_name, errno, "while trying to execv %s",
-                params[0]);
+        com_err(prog_name, errno, _("while trying to execv %s"), params[0]);
         sweep_up(ksu_context, cc_target);
         exit(1);
     }else{
@@ -817,17 +818,18 @@ main (argc, argv)
                 printf("The exit status of the child is %d\n", statusp);
             }
             if (ret_pid == -1) {
-                com_err(prog_name, errno, "while calling waitpid");
+                com_err(prog_name, errno, _("while calling waitpid"));
             }
             sweep_up(ksu_context, cc_target);
             exit (statusp);
         case -1:
-            com_err(prog_name, errno, "while trying to fork.");
+            com_err(prog_name, errno, _("while trying to fork."));
             sweep_up(ksu_context, cc_target);
             exit (1);
         case 0:
             execv(params[0], params);
-            com_err(prog_name, errno, "while trying to execv %s", params[0]);
+            com_err(prog_name, errno, _("while trying to execv %s"),
+                    params[0]);
             exit (1);
         }
     }
@@ -859,7 +861,7 @@ static char * ontty()
     if ((p = ttyname(STDERR_FILENO))) {
         result = snprintf(buf, sizeof(buf), " on %s", p);
         if (SNPRINTF_OVERFLOW(result, sizeof(buf))) {
-            fprintf (stderr, "terminal name %s too long\n", p);
+            fprintf(stderr, _("terminal name %s too long\n"), p);
             exit (1);
         }
     }
@@ -889,16 +891,14 @@ static void sweep_up(context, cc)
     krb5_seteuid(0);
     if (krb5_seteuid(target_uid) < 0) {
         com_err(prog_name, errno,
-                "while changing to target uid for destroying ccache");
+                _("while changing to target uid for destroying ccache"));
         exit(1);
     }
 
     cc_name = krb5_cc_get_name(context, cc);
     if ( ! stat(cc_name, &st_temp)){
-        if ((retval = krb5_cc_destroy(context, cc))){
-            com_err(prog_name, retval,
-                    "while destroying cache");
-        }
+        if ((retval = krb5_cc_destroy(context, cc)))
+            com_err(prog_name, retval, _("while destroying cache"));
     }
 }
 
diff --git a/src/clients/kvno/kvno.c b/src/clients/kvno/kvno.c
index 3f01b0eb99..9173daa769 100644
--- a/src/clients/kvno/kvno.c
+++ b/src/clients/kvno/kvno.c
@@ -27,7 +27,7 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include "autoconf.h"
+#include "k5-platform.h"
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
@@ -40,9 +40,9 @@ static char *prog;
 
 static void xusage()
 {
-    fprintf(stderr, "usage: %s [-C] [-u] [-c ccache] [-e etype]\n", prog);
-    fprintf(stderr, "\t[-k keytab] [-S sname] [-U for_user [-P]]\n");
-    fprintf(stderr, "\tservice1 service2 ...\n");
+    fprintf(stderr, _("usage: %s [-C] [-u] [-c ccache] [-e etype]\n"), prog);
+    fprintf(stderr, _("\t[-k keytab] [-S sname] [-U for_user [-P]]\n"));
+    fprintf(stderr, _("\tservice1 service2 ...\n"));
     exit(1);
 }
 
@@ -96,14 +96,16 @@ int main(int argc, char *argv[])
         case 'S':
             sname = optarg;
             if (unknown == 1){
-                fprintf(stderr, "Options -u and -S are mutually exclusive\n");
+                fprintf(stderr,
+                        _("Options -u and -S are mutually exclusive\n"));
                 xusage();
             }
             break;
         case 'u':
             unknown = 1;
             if (sname){
-                fprintf(stderr, "Options -u and -S are mutually exclusive\n");
+                fprintf(stderr,
+                        _("Options -u and -S are mutually exclusive\n"));
                 xusage();
             }
             break;
@@ -118,12 +120,12 @@ int main(int argc, char *argv[])
 
     if (proxy) {
         if (keytab_name == NULL) {
-            fprintf(stderr, "Option -P (constrained delegation) "
-                    "requires keytab to be specified\n");
+            fprintf(stderr, _("Option -P (constrained delegation) "
+                              "requires keytab to be specified\n"));
             xusage();
         } else if (for_user == NULL) {
-            fprintf(stderr, "Option -P (constrained delegation) requires "
-                    "option -U (protocol transition)\n");
+            fprintf(stderr, _("Option -P (constrained delegation) requires "
+                              "option -U (protocol transition)\n"));
             xusage();
         }
     }
@@ -167,14 +169,14 @@ static void do_v5_kvno (int count, char *names[],
 
     ret = krb5_init_context(&context);
     if (ret) {
-        com_err(prog, ret, "while initializing krb5 library");
+        com_err(prog, ret, _("while initializing krb5 library"));
         exit(1);
     }
 
     if (etypestr) {
         ret = krb5_string_to_enctype(etypestr, &etype);
         if (ret) {
-            com_err(prog, ret, "while converting etype");
+            com_err(prog, ret, _("while converting etype"));
             exit(1);
         }
     } else {
@@ -186,14 +188,14 @@ static void do_v5_kvno (int count, char *names[],
     else
         ret = krb5_cc_default(context, &ccache);
     if (ret) {
-        com_err(prog, ret, "while opening ccache");
+        com_err(prog, ret, _("while opening ccache"));
         exit(1);
     }
 
     if (keytab_name) {
         ret = krb5_kt_resolve(context, keytab_name, &keytab);
         if (ret) {
-            com_err(prog, ret, "resolving keytab %s", keytab_name);
+            com_err(prog, ret, _("resolving keytab %s"), keytab_name);
             exit(1);
         }
     }
@@ -203,14 +205,14 @@ static void do_v5_kvno (int count, char *names[],
                                     KRB5_PRINCIPAL_PARSE_ENTERPRISE,
                                     &for_user_princ);
         if (ret) {
-            com_err(prog, ret, "while parsing principal name %s", for_user);
+            com_err(prog, ret, _("while parsing principal name %s"), for_user);
             exit(1);
         }
     }
 
     ret = krb5_cc_get_principal(context, ccache, &me);
     if (ret) {
-        com_err(prog, ret, "while getting client principal name");
+        com_err(prog, ret, _("while getting client principal name"));
         exit(1);
     }
 
@@ -236,8 +238,10 @@ static void do_v5_kvno (int count, char *names[],
             ret = krb5_parse_name(context, names[i], &server);
         }
         if (ret) {
-            if (!quiet)
-                com_err(prog, ret, "while parsing principal name %s", names[i]);
+            if (!quiet) {
+                com_err(prog, ret, _("while parsing principal name %s"),
+                        names[i]);
+            }
             goto error;
         }
         if (unknown == 1) {
@@ -246,9 +250,8 @@ static void do_v5_kvno (int count, char *names[],
 
         ret = krb5_unparse_name(context, server, &princ);
         if (ret) {
-            com_err(prog, ret,
-                    "while formatting parsed principal name for '%s'",
-                    names[i]);
+            com_err(prog, ret, _("while formatting parsed principal name for "
+                                 "'%s'"), names[i]);
             goto error;
         }
 
@@ -258,7 +261,7 @@ static void do_v5_kvno (int count, char *names[],
             if (!proxy &&
                 !krb5_principal_compare(context, me, server)) {
                 com_err(prog, EINVAL,
-                        "client and server principal names must match");
+                        _("client and server principal names must match"));
                 goto error;
             }
 
@@ -275,14 +278,14 @@ static void do_v5_kvno (int count, char *names[],
         }
 
         if (ret) {
-            com_err(prog, ret, "while getting credentials for %s", princ);
+            com_err(prog, ret, _("while getting credentials for %s"), princ);
             goto error;
         }
 
         /* we need a native ticket */
         ret = krb5_decode_ticket(&out_creds->ticket, &ticket);
         if (ret) {
-            com_err(prog, ret, "while decoding ticket for %s", princ);
+            com_err(prog, ret, _("while decoding ticket for %s"), princ);
             goto error;
         }
 
@@ -293,12 +296,13 @@ static void do_v5_kvno (int count, char *names[],
                     fprintf(stderr, "%s: kvno = %d, keytab entry invalid\n",
                             princ, ticket->enc_part.kvno);
                 }
-                com_err(prog, ret, "while decrypting ticket for %s", princ);
+                com_err(prog, ret, _("while decrypting ticket for %s"), princ);
                 goto error;
             }
-            if (!quiet)
-                printf("%s: kvno = %d, keytab entry valid\n",
+            if (!quiet) {
+                printf(_("%s: kvno = %d, keytab entry valid\n"),
                        princ, ticket->enc_part.kvno);
+            }
             if (proxy) {
                 krb5_free_creds(context, out_creds);
                 out_creds = NULL;
@@ -314,13 +318,13 @@ static void do_v5_kvno (int count, char *names[],
                                                      &out_creds);
                 if (ret) {
                     com_err(prog, ret,
-                            "%s: constrained delegation failed", princ);
+                            _("%s: constrained delegation failed"), princ);
                     goto error;
                 }
             }
         } else {
             if (!quiet)
-                printf("%s: kvno = %d\n", princ, ticket->enc_part.kvno);
+                printf(_("%s: kvno = %d\n"), princ, ticket->enc_part.kvno);
         }
 
         continue;
diff --git a/src/kadmin/cli/kadmin.c b/src/kadmin/cli/kadmin.c
index 05561b671b..fedee85b1e 100644
--- a/src/kadmin/cli/kadmin.c
+++ b/src/kadmin/cli/kadmin.c
@@ -119,12 +119,16 @@ static void
 usage()
 {
     fprintf(stderr,
-            "Usage: %s [-r realm] [-p principal] [-q query] [clnt|local args]\n"
-            "\tclnt args: [-s admin_server[:port]] [[-c ccache]|[-k [-t keytab]]]|[-n]\n"
-            "\tlocal args: [-x db_args]* [-d dbname] [-e \"enc:salt ...\"] [-m]\n"
-            "where,\n\t[-x db_args]* - any number of database specific arguments.\n"
-            "\t\t\tLook at each database documentation for supported arguments\n",
-            whoami);
+            _("Usage: %s [-r realm] [-p principal] [-q query] "
+              "[clnt|local args]\n"
+              "\tclnt args: [-s admin_server[:port]] "
+              "[[-c ccache]|[-k [-t keytab]]]|[-n]\n"
+              "\tlocal args: [-x db_args]* [-d dbname] "
+              "[-e \"enc:salt ...\"] [-m]\n"
+              "where,\n\t[-x db_args]* - any number of database specific "
+              "arguments.\n"
+              "\t\t\tLook at each database documentation for supported "
+              "arguments\n"), whoami);
     exit(1);
 }
 
@@ -267,7 +271,7 @@ kadmin_startup(int argc, char *argv[])
 
     retval = kadm5_init_krb5_context(&context);
     if (retval) {
-        com_err(whoami, retval, "while initializing krb5 library");
+        com_err(whoami, retval, _("while initializing krb5 library"));
         exit(1);
     }
 
@@ -278,7 +282,8 @@ kadmin_startup(int argc, char *argv[])
             db_args_size++;
             db_args = realloc(db_args, sizeof(char*) * (db_args_size + 1));
             if (db_args == NULL) {
-                fprintf(stderr, "%s: Cannot initialize. Not enough memory\n",
+                fprintf(stderr,
+                        _("%s: Cannot initialize. Not enough memory\n"),
                         argv[0]);
                 exit(1);
             }
@@ -318,7 +323,8 @@ kadmin_startup(int argc, char *argv[])
             db_args_size++;
             db_args = realloc(db_args, sizeof(char*) * (db_args_size + 1));
             if (db_args == NULL) {
-                fprintf(stderr, "%s: Cannot initialize. Not enough memory\n",
+                fprintf(stderr,
+                        _("%s: Cannot initialize. Not enough memory\n"),
                         argv[0]);
                 exit(1);
             }
@@ -338,7 +344,8 @@ kadmin_startup(int argc, char *argv[])
                                              &params.keysalts,
                                              &params.num_keysalts);
             if (retval) {
-                com_err(whoami, retval, "while parsing keysalts %s", optarg);
+                com_err(whoami, retval, _("while parsing keysalts %s"),
+                        optarg);
                 exit(1);
             }
             params.mask |= KADM5_CONFIG_ENCTYPES;
@@ -360,7 +367,7 @@ kadmin_startup(int argc, char *argv[])
         usage();
 
     if (def_realm == NULL && krb5_get_default_realm(context, &def_realm)) {
-        fprintf(stderr, "%s: unable to get default realm\n", whoami);
+        fprintf(stderr, _("%s: unable to get default realm\n"), whoami);
         exit(1);
     }
 
@@ -379,13 +386,14 @@ kadmin_startup(int argc, char *argv[])
     if (ccache_name == NULL) {
         retval = krb5_cc_default(context, &cc);
         if (retval) {
-            com_err(whoami, retval, "while opening default credentials cache");
+            com_err(whoami, retval,
+                    _("while opening default credentials cache"));
             exit(1);
         }
     } else {
         retval = krb5_cc_resolve(context, ccache_name, &cc);
         if (retval) {
-            com_err(whoami, retval, "while opening credentials cache %s",
+            com_err(whoami, retval, _("while opening credentials cache %s"),
                     ccache_name);
             exit(1);
         }
@@ -407,7 +415,8 @@ kadmin_startup(int argc, char *argv[])
             !krb5_cc_get_principal(context, cc, &princ)) {
             retval = krb5_unparse_name(context, princ, &princstr);
             if (retval) {
-                com_err(whoami, retval, "while canonicalizing principal name");
+                com_err(whoami, retval,
+                        _("while canonicalizing principal name"));
                 exit(1);
             }
             krb5_free_principal(context, princ);
@@ -416,19 +425,20 @@ kadmin_startup(int argc, char *argv[])
             retval = krb5_sname_to_principal(context, NULL, "host",
                                              KRB5_NT_SRV_HST, &princ);
             if (retval) {
-                com_err(whoami, retval, "creating host service principal");
+                com_err(whoami, retval, _("creating host service principal"));
                 exit(1);
             }
             retval = krb5_unparse_name(context, princ, &princstr);
             if (retval) {
-                com_err(whoami, retval, "while canonicalizing principal name");
+                com_err(whoami, retval,
+                        _("while canonicalizing principal name"));
                 exit(1);
             }
             krb5_free_principal(context, princ);
             freeprinc++;
         } else if (!krb5_cc_get_principal(context, cc, &princ)) {
             if (krb5_unparse_name(context, princ, &canon)) {
-                fprintf(stderr, "%s: unable to canonicalize principal\n",
+                fprintf(stderr, _("%s: unable to canonicalize principal\n"),
                         whoami);
                 exit(1);
             }
@@ -452,7 +462,7 @@ kadmin_startup(int argc, char *argv[])
             if (asprintf(&princstr, "%s/admin%s%s", canon,
                          (realm) ? "@" : "",
                          (realm) ? realm : "") < 0) {
-                fprintf(stderr, "%s: out of memory\n", whoami);
+                fprintf(stderr, _("%s: out of memory\n"), whoami);
                 exit(1);
             }
             free(canon);
@@ -460,19 +470,19 @@ kadmin_startup(int argc, char *argv[])
             freeprinc++;
         } else if ((luser = getenv("USER"))) {
             if (asprintf(&princstr, "%s/admin@%s", luser, def_realm) < 0) {
-                fprintf(stderr, "%s: out of memory\n", whoami);
+                fprintf(stderr, _("%s: out of memory\n"), whoami);
                 exit(1);
             }
             freeprinc++;
         } else if ((pw = getpwuid(getuid()))) {
             if (asprintf(&princstr, "%s/admin@%s", pw->pw_name,
                          def_realm) < 0) {
-                fprintf(stderr, "%s: out of memory\n", whoami);
+                fprintf(stderr, _("%s: out of memory\n"), whoami);
                 exit(1);
             }
             freeprinc++;
         } else {
-            fprintf(stderr, "%s: unable to figure out a principal name\n",
+            fprintf(stderr, _("%s: unable to figure out a principal name\n"),
                     whoami);
             exit(1);
         }
@@ -480,7 +490,7 @@ kadmin_startup(int argc, char *argv[])
 
     retval = krb5_klog_init(context, "admin_server", whoami, 0);
     if (retval) {
-        com_err(whoami, retval, "while setting up logging");
+        com_err(whoami, retval, _("while setting up logging"));
         exit(1);
     }
 
@@ -489,29 +499,29 @@ kadmin_startup(int argc, char *argv[])
      * use it.  Otherwise, use/prompt for the password.
      */
     if (ccache_name) {
-        printf("Authenticating as principal %s with existing credentials.\n",
-               princstr);
+        printf(_("Authenticating as principal %s with existing "
+                 "credentials.\n"), princstr);
         retval = kadm5_init_with_creds(context, princstr, cc, svcname, &params,
                                        KADM5_STRUCT_VERSION,
                                        KADM5_API_VERSION_3, db_args, &handle);
     } else if (use_anonymous) {
-        printf("Authenticating as principal %s with password; "
-               "anonymous requested.\n", princstr);
+        printf(_("Authenticating as principal %s with password; "
+                 "anonymous requested.\n"), princstr);
         retval = kadm5_init_anonymous(context, princstr, svcname, &params,
                                       KADM5_STRUCT_VERSION,
                                       KADM5_API_VERSION_3, db_args, &handle);
     } else if (use_keytab) {
         if (keytab_name)
-            printf("Authenticating as principal %s with keytab %s.\n",
+            printf(_("Authenticating as principal %s with keytab %s.\n"),
                    princstr, keytab_name);
         else
-            printf("Authenticating as principal %s with default keytab.\n",
+            printf(_("Authenticating as principal %s with default keytab.\n"),
                    princstr);
         retval = kadm5_init_with_skey(context, princstr, keytab_name, svcname,
                                       &params, KADM5_STRUCT_VERSION,
                                       KADM5_API_VERSION_3, db_args, &handle);
     } else {
-        printf("Authenticating as principal %s with password.\n",
+        printf(_("Authenticating as principal %s with password.\n"),
                princstr);
         retval = kadm5_init_with_password(context, princstr, password, svcname,
                                           &params, KADM5_STRUCT_VERSION,
@@ -519,7 +529,7 @@ kadmin_startup(int argc, char *argv[])
                                           &handle);
     }
     if (retval) {
-        com_err(whoami, retval, "while initializing %s interface", whoami);
+        com_err(whoami, retval, _("while initializing %s interface"), whoami);
         if (retval == KADM5_BAD_CLIENT_PARAMS ||
             retval == KADM5_BAD_SERVER_PARAMS)
             usage();
@@ -533,7 +543,7 @@ kadmin_startup(int argc, char *argv[])
 
     retval = krb5_cc_close(context, cc);
     if (retval) {
-        com_err(whoami, retval, "while closing ccache %s", ccache_name);
+        com_err(whoami, retval, _("while closing ccache %s"), ccache_name);
         exit(1);
     }
 
@@ -554,15 +564,17 @@ quit()
     if (locked) {
         retval = kadm5_unlock(handle);
         if (retval) {
-            com_err("quit", retval, "while unlocking locked database");
+            com_err("quit", retval, _("while unlocking locked database"));
             return 1;
         }
         locked = 0;
     }
 
     kadm5_destroy(handle);
-    if (ccache_name != NULL)
-        fprintf(stderr, "\n\a\a\aAdministration credentials NOT DESTROYED.\n");
+    if (ccache_name != NULL) {
+        fprintf(stderr, "\n\a\a\a%s",
+                _("Administration credentials NOT DESTROYED.\n"));
+    }
 
     /* insert more random cleanup here */
     krb5_klog_close(context);
@@ -610,36 +622,38 @@ kadmin_delprinc(int argc, char *argv[])
 
     if (! (argc == 2 ||
            (argc == 3 && !strcmp("-force", argv[1])))) {
-        fprintf(stderr, "usage: delete_principal [-force] principal\n");
+        fprintf(stderr, _("usage: delete_principal [-force] principal\n"));
         return;
     }
     retval = kadmin_parse_name(argv[argc - 1], &princ);
     if (retval) {
-        com_err("delete_principal", retval, "while parsing principal name");
+        com_err("delete_principal", retval, _("while parsing principal name"));
         return;
     }
     retval = krb5_unparse_name(context, princ, &canon);
     if (retval) {
-        com_err("delete_principal", retval, "while canonicalizing principal");
+        com_err("delete_principal", retval,
+                _("while canonicalizing principal"));
         goto cleanup;
     }
     if (argc == 2) {
-        printf("Are you sure you want to delete the principal \"%s\"? "
-               "(yes/no): ", canon);
+        printf(_("Are you sure you want to delete the principal \"%s\"? "
+                 "(yes/no): "), canon);
         fgets(reply, sizeof (reply), stdin);
         if (strcmp("yes\n", reply)) {
-            fprintf(stderr, "Principal \"%s\" not deleted\n", canon);
+            fprintf(stderr, _("Principal \"%s\" not deleted\n"), canon);
             goto cleanup;
         }
     }
     retval = kadm5_delete_principal(handle, princ);
     if (retval) {
         com_err("delete_principal", retval,
-                "while deleting principal \"%s\"", canon);
+                _("while deleting principal \"%s\""), canon);
         goto cleanup;
     }
-    printf("Principal \"%s\" deleted.\nMake sure that you have removed this "
-           "principal from all ACLs before reusing.\n", canon);
+    printf(_("Principal \"%s\" deleted.\n"), canon);
+    printf(_("Make sure that you have removed this principal from all ACLs "
+             "before reusing.\n"));
 
 cleanup:
     krb5_free_principal(context, princ);
@@ -655,52 +669,53 @@ kadmin_renameprinc(int argc, char *argv[])
     char reply[5];
 
     if (!(argc == 3 || (argc == 4 && !strcmp("-force", argv[1])))) {
-        fprintf(stderr, "usage: rename_principal [-force] old_principal "
-                "new_principal\n");
+        fprintf(stderr, _("usage: rename_principal [-force] old_principal "
+                          "new_principal\n"));
         return;
     }
     retval = kadmin_parse_name(argv[argc - 2], &oprinc);
     if (retval) {
         com_err("rename_principal", retval,
-                "while parsing old principal name");
+                _("while parsing old principal name"));
         goto cleanup;
     }
     retval = kadmin_parse_name(argv[argc - 1], &nprinc);
     if (retval) {
         com_err("rename_principal", retval,
-                "while parsing new principal name");
+                _("while parsing new principal name"));
         goto cleanup;
     }
     retval = krb5_unparse_name(context, oprinc, &ocanon);
     if (retval) {
         com_err("rename_principal", retval,
-                "while canonicalizing old principal");
+                _("while canonicalizing old principal"));
         goto cleanup;
     }
     retval = krb5_unparse_name(context, nprinc, &ncanon);
     if (retval) {
         com_err("rename_principal", retval,
-                "while canonicalizing new principal");
+                _("while canonicalizing new principal"));
         goto cleanup;
     }
     if (argc == 3) {
-        printf("Are you sure you want to rename the principal \"%s\" "
-               "to \"%s\"? (yes/no): ", ocanon, ncanon);
+        printf(_("Are you sure you want to rename the principal \"%s\" "
+                 "to \"%s\"? (yes/no): "), ocanon, ncanon);
         fgets(reply, sizeof(reply), stdin);
         if (strcmp("yes\n", reply)) {
-            fprintf(stderr, "Principal \"%s\" not renamed\n", ocanon);
+            fprintf(stderr, _("Principal \"%s\" not renamed\n"), ocanon);
             goto cleanup;
         }
     }
     retval = kadm5_rename_principal(handle, oprinc, nprinc);
     if (retval) {
         com_err("rename_principal", retval,
-                "while renaming principal \"%s\" to \"%s\"", ocanon, ncanon);
+                _("while renaming principal \"%s\" to \"%s\""),
+                ocanon, ncanon);
         goto cleanup;
     }
-    printf("Principal \"%s\" renamed to \"%s\".\n"
-           "Make sure that you have removed the old principal from all ACLs "
-           "before reusing.\n", ocanon, ncanon);
+    printf(_("Principal \"%s\" renamed to \"%s\".\n"), ocanon, ncanon);
+    printf(_("Make sure that you have removed the old principal from all ACLs "
+             "before reusing.\n"));
 
 cleanup:
     krb5_free_principal(context, nprinc);
@@ -714,8 +729,8 @@ cpw_usage(const char *str)
 {
     if (str)
         fprintf(stderr, "%s\n", str);
-    fprintf(stderr, "usage: change_password [-randkey] [-keepold] "
-            "[-e keysaltlist] [-pw password] principal\n");
+    fprintf(stderr, _("usage: change_password [-randkey] [-keepold] "
+                      "[-e keysaltlist] [-pw password] principal\n"));
 }
 
 void
@@ -740,13 +755,13 @@ kadmin_cpw(int argc, char *argv[])
         if (!strcmp("-x", *argv)) {
             argc--;
             if (argc < 1) {
-                cpw_usage("change_password: missing db argument");
+                cpw_usage(_("change_password: missing db argument"));
                 goto cleanup;
             }
             db_args_size++;
             db_args = realloc(db_args, sizeof(char*) * (db_args_size + 1));
             if (db_args == NULL) {
-                fprintf(stderr, "change_password: Not enough memory\n");
+                fprintf(stderr, _("change_password: Not enough memory\n"));
                 exit(1);
             }
             db_args[db_args_size - 1] = *++argv;
@@ -754,7 +769,7 @@ kadmin_cpw(int argc, char *argv[])
         } else if (!strcmp("-pw", *argv)) {
             argc--;
             if (argc < 1) {
-                cpw_usage("change_password: missing password arg");
+                cpw_usage(_("change_password: missing password arg"));
                 goto cleanup;
             }
             pwarg = *++argv;
@@ -765,14 +780,14 @@ kadmin_cpw(int argc, char *argv[])
         } else if (!strcmp("-e", *argv)) {
             argc--;
             if (argc < 1) {
-                cpw_usage("change_password: missing keysaltlist arg");
+                cpw_usage(_("change_password: missing keysaltlist arg"));
                 goto cleanup;
             }
             retval = krb5_string_to_keysalts(*++argv, ", \t", ":.-", 0,
                                              &ks_tuple, &n_ks_tuple);
             if (retval) {
                 com_err("change_password", retval,
-                        "while parsing keysalts %s", *argv);
+                        _("while parsing keysalts %s"), *argv);
                 goto cleanup;
             }
         } else {
@@ -781,18 +796,19 @@ kadmin_cpw(int argc, char *argv[])
         }
     }
     if (*argv == NULL) {
-        com_err("change_password", 0, "missing principal name");
+        com_err("change_password", 0, _("missing principal name"));
         cpw_usage(NULL);
         goto cleanup;
     }
     retval = kadmin_parse_name(*argv, &princ);
     if (retval) {
-        com_err("change_password", retval, "while parsing principal name");
+        com_err("change_password", retval, _("while parsing principal name"));
         goto cleanup;
     }
     retval = krb5_unparse_name(context, princ, &canon);
     if (retval) {
-        com_err("change_password", retval, "while canonicalizing principal");
+        com_err("change_password", retval,
+                _("while canonicalizing principal"));
         goto cleanup;
     }
     if (pwarg != NULL) {
@@ -804,30 +820,30 @@ kadmin_cpw(int argc, char *argv[])
         }
         if (retval) {
             com_err("change_password", retval,
-                    "while changing password for \"%s\".", canon);
+                    _("while changing password for \"%s\"."), canon);
             goto cleanup;
         }
-        printf("Password for \"%s\" changed.\n", canon);
+        printf(_("Password for \"%s\" changed.\n"), canon);
     } else if (randkey) {
         retval = randkey_princ(princ, keepold, n_ks_tuple, ks_tuple);
         if (retval) {
             com_err("change_password", retval,
-                    "while randomizing key for \"%s\".", canon);
+                    _("while randomizing key for \"%s\"."), canon);
             goto cleanup;
         }
-        printf("Key for \"%s\" randomized.\n", canon);
+        printf(_("Key for \"%s\" randomized.\n"), canon);
     } else {
         unsigned int i = sizeof (newpw) - 1;
 
         snprintf(prompt1, sizeof(prompt1),
-                 "Enter password for principal \"%s\"", canon);
+                 _("Enter password for principal \"%s\""), canon);
         snprintf(prompt2, sizeof(prompt2),
-                 "Re-enter password for principal \"%s\"", canon);
+                 _("Re-enter password for principal \"%s\""), canon);
         retval = krb5_read_password(context, prompt1, prompt2,
                                     newpw, &i);
         if (retval) {
             com_err("change_password", retval,
-                    "while reading password for \"%s\".", canon);
+                    _("while reading password for \"%s\"."), canon);
             goto cleanup;
         }
         if (keepold || ks_tuple != NULL) {
@@ -840,10 +856,10 @@ kadmin_cpw(int argc, char *argv[])
         memset(newpw, 0, sizeof (newpw));
         if (retval) {
             com_err("change_password", retval,
-                    "while changing password for \"%s\".", canon);
+                    _("while changing password for \"%s\"."), canon);
             goto cleanup;
         }
-        printf("Password for \"%s\" changed.\n", canon);
+        printf(_("Password for \"%s\" changed.\n"), canon);
     }
 cleanup:
     free(canon);
@@ -881,7 +897,7 @@ add_tl_data(kadm5_principal_ent_t princ, krb5_int16 tl_type, krb5_ui_2 len,
     copy = malloc(len);
     tl_data = calloc(1, sizeof(*tl_data));
     if (copy == NULL || tl_data == NULL) {
-        fprintf(stderr, "Not enough memory\n");
+        fprintf(stderr, _("Not enough memory\n"));
         exit(1);
     }
     memcpy(copy, contents, len);
@@ -911,7 +927,7 @@ unlock_princ(kadm5_principal_ent_t princ, long *mask, const char *caller)
      * see it, since fail_auth_count is unreplicated. */
     retval = krb5_timeofday(context, &now);
     if (retval) {
-        com_err(caller, retval, "while getting time");
+        com_err(caller, retval, _("while getting time"));
         exit(1);
     }
     store_32_le((krb5_int32)now, timebuf);
@@ -965,7 +981,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -980,7 +996,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -995,7 +1011,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -1010,7 +1026,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -1075,8 +1091,8 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
                 retval = krb5_string_to_keysalts(argv[i], ", \t", ":.-", 0,
                                                  ks_tuple, n_ks_tuple);
                 if (retval) {
-                    com_err(caller, retval,
-                            "while parsing keysalts %s", argv[i]);
+                    com_err(caller, retval, _("while parsing keysalts %s"),
+                            argv[i]);
                     return -1;
                 }
             }
@@ -1110,7 +1126,7 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
         return -1;
     retval = kadmin_parse_name(argv[i], &oprinc->principal);
     if (retval) {
-        com_err(caller, retval, "while parsing principal");
+        com_err(caller, retval, _("while parsing principal"));
         return -1;
     }
     return 0;
@@ -1119,42 +1135,54 @@ kadmin_parse_princ_args(int argc, char *argv[], kadm5_principal_ent_t oprinc,
 static void
 kadmin_addprinc_usage()
 {
-    fprintf(stderr, "usage: add_principal [options] principal\n");
-    fprintf(stderr, "\toptions are:\n");
-    fprintf(stderr, "\t\t[-x db_princ_args]* [-expire expdate] "
+    fprintf(stderr, _("usage: add_principal [options] principal\n"));
+    fprintf(stderr, _("\toptions are:\n"));
+    fprintf(stderr, _("\t\t[-x db_princ_args]* [-expire expdate] "
             "[-pwexpire pwexpdate] [-maxlife maxtixlife]\n"
             "\t\t[-kvno kvno] [-policy policy] [-clearpolicy] [-randkey]\n"
             "\t\t[-pw password] [-maxrenewlife maxrenewlife]\n"
-            "\t\t[-e keysaltlist]\n\t\t[{+|-}attribute]\n"
-#if APPLE_PKINIT
-            "\t\t[-certhash hash_string]\n"
-#endif /* APPLE_PKINIT */
+                      "\t\t[-e keysaltlist]\n\t\t[{+|-}attribute]\n")
     );
-    fprintf(stderr, "\tattributes are:\n");
-    fprintf(stderr, "%s%s%s",
-            "\t\tallow_postdated allow_forwardable allow_tgs_req allow_renewable\n",
-            "\t\tallow_proxiable allow_dup_skey allow_tix requires_preauth\n",
-            "\t\trequires_hwauth needchange allow_svr password_changing_service\n"
-            "\t\tok_as_delegate ok_to_auth_as_delegate no_auth_data_required\n"
-            "\nwhere,\n\t[-x db_princ_args]* - any number of database specific arguments.\n"
-            "\t\t\tLook at each database documentation for supported arguments\n");
+    fprintf(stderr, _("\tattributes are:\n"));
+    fprintf(stderr,
+            _("\t\tallow_postdated allow_forwardable allow_tgs_req "
+              "allow_renewable\n"
+              "\t\tallow_proxiable allow_dup_skey allow_tix requires_preauth\n"
+              "\t\trequires_hwauth needchange allow_svr "
+              "password_changing_service\n"
+              "\t\tok_as_delegate ok_to_auth_as_delegate "
+              "no_auth_data_required\n"
+              "\nwhere,\n\t[-x db_princ_args]* - any number of database "
+              "specific arguments.\n"
+              "\t\t\tLook at each database documentation for supported "
+              "arguments\n"));
 }
 
 static void
 kadmin_modprinc_usage()
 {
-    fprintf(stderr, "usage: modify_principal [options] principal\n");
-    fprintf(stderr, "\toptions are:\n");
-    fprintf(stderr, "\t\t[-x db_princ_args]* [-expire expdate] [-pwexpire pwexpdate] [-maxlife maxtixlife]\n\t\t[-kvno kvno] [-policy policy] [-clearpolicy]\n\t\t[-maxrenewlife maxrenewlife] [-unlock] [{+|-}attribute]\n");
+    fprintf(stderr, _("usage: modify_principal [options] principal\n"));
+    fprintf(stderr, _("\toptions are:\n"));
+    fprintf(stderr,
+            _("\t\t[-x db_princ_args]* [-expire expdate] "
+              "[-pwexpire pwexpdate] [-maxlife maxtixlife]\n"
+              "\t\t[-kvno kvno] [-policy policy] [-clearpolicy]\n"
+              "\t\t[-maxrenewlife maxrenewlife] [-unlock] "
+              "[{+|-}attribute]\n"));
     fprintf(stderr, "\tattributes are:\n");
-    fprintf(stderr, "%s%s%s",
-            "\t\tallow_postdated allow_forwardable allow_tgs_req allow_renewable\n",
-            "\t\tallow_proxiable allow_dup_skey allow_tix requires_preauth\n",
-            "\t\trequires_hwauth needchange allow_svr password_changing_service\n"
-            "\t\tok_as_delegate ok_to_auth_as_delegate no_auth_data_required\n"
-            "\nwhere,\n\t[-x db_princ_args]* - any number of database specific arguments.\n"
-            "\t\t\tLook at each database documentation for supported arguments\n"
-    );
+    fprintf(stderr,
+            _("\t\tallow_postdated allow_forwardable allow_tgs_req "
+              "allow_renewable\n"
+              "\t\tallow_proxiable allow_dup_skey allow_tix "
+              "requires_preauth\n"
+              "\t\trequires_hwauth needchange allow_svr "
+              "password_changing_service\n"
+              "\t\tok_as_delegate ok_to_auth_as_delegate "
+              "no_auth_data_required\n"
+              "\nwhere,\n\t[-x db_princ_args]* - any number of database "
+              "specific arguments.\n"
+              "\t\t\tLook at each database documentation for supported "
+              "arguments\n"));
 }
 
 /* Create a dummy password for old-style (pre-1.8) randkey creation. */
@@ -1211,7 +1239,7 @@ kadmin_addprinc(int argc, char *argv[])
 
     retval = krb5_unparse_name(context, princ.principal, &canon);
     if (retval) {
-        com_err("add_principal", retval, "while canonicalizing principal");
+        com_err("add_principal", retval, _("while canonicalizing principal"));
         goto cleanup;
     }
 
@@ -1223,14 +1251,14 @@ kadmin_addprinc(int argc, char *argv[])
      */
     if (!(mask & KADM5_POLICY) && !(mask & KADM5_POLICY_CLR)) {
         if (!kadm5_get_policy(handle, "default", &defpol)) {
-            fprintf(stderr, "NOTICE: no policy specified for %s; "
-                    "assigning \"default\"\n", canon);
+            fprintf(stderr, _("NOTICE: no policy specified for %s; "
+                              "assigning \"default\"\n"), canon);
             princ.policy = "default";
             mask |= KADM5_POLICY;
             kadm5_free_policy_ent(handle, &defpol);
         } else
-            fprintf(stderr, "WARNING: no policy specified for %s; "
-                    "defaulting to no policy\n", canon);
+            fprintf(stderr, _("WARNING: no policy specified for %s; "
+                              "defaulting to no policy\n"), canon);
     }
     mask &= ~KADM5_POLICY_CLR;
 
@@ -1240,13 +1268,13 @@ kadmin_addprinc(int argc, char *argv[])
         unsigned int sz = sizeof(newpw) - 1;
 
         snprintf(prompt1, sizeof(prompt1),
-                 "Enter password for principal \"%s\"", canon);
+                 _("Enter password for principal \"%s\""), canon);
         snprintf(prompt2, sizeof(prompt2),
-                 "Re-enter password for principal \"%s\"", canon);
+                 _("Re-enter password for principal \"%s\""), canon);
         retval = krb5_read_password(context, prompt1, prompt2, newpw, &sz);
         if (retval) {
             com_err("add_principal", retval,
-                    "while reading password for \"%s\".", canon);
+                    _("while reading password for \"%s\"."), canon);
             goto cleanup;
         }
         pass = newpw;
@@ -1274,7 +1302,7 @@ kadmin_addprinc(int argc, char *argv[])
         retval = randkey_princ(princ.principal, FALSE, n_ks_tuple, ks_tuple);
         if (retval) {
             com_err("add_principal", retval,
-                    "while randomizing key for \"%s\".", canon);
+                    _("while randomizing key for \"%s\"."), canon);
             goto cleanup;
         }
         princ.attributes &= ~KRB5_KDB_DISALLOW_ALL_TIX; /* clear notix */
@@ -1282,7 +1310,7 @@ kadmin_addprinc(int argc, char *argv[])
         retval = kadm5_modify_principal(handle, &princ, mask);
         if (retval) {
             com_err("add_principal", retval,
-                    "while clearing DISALLOW_ALL_TIX for \"%s\".", canon);
+                    _("while clearing DISALLOW_ALL_TIX for \"%s\"."), canon);
             goto cleanup;
         }
     }
@@ -1320,18 +1348,19 @@ kadmin_modprinc(int argc, char *argv[])
 
     retval = kadmin_parse_name(argv[argc - 1], &kprinc);
     if (retval) {
-        com_err("modify_principal", retval, "while parsing principal");
+        com_err("modify_principal", retval, _("while parsing principal"));
         return;
     }
     retval = krb5_unparse_name(context, kprinc, &canon);
     if (retval) {
-        com_err("modify_principal", retval, "while canonicalizing principal");
+        com_err("modify_principal", retval,
+                _("while canonicalizing principal"));
         goto cleanup;
     }
     retval = kadm5_get_principal(handle, kprinc, &oldprinc,
                                  KADM5_PRINCIPAL_NORMAL_MASK);
     if (retval) {
-        com_err("modify_principal", retval, "while getting \"%s\".", canon);
+        com_err("modify_principal", retval, _("while getting \"%s\"."), canon);
         goto cleanup;
     }
     princ.attributes = oldprinc.attributes;
@@ -1380,10 +1409,11 @@ kadmin_modprinc(int argc, char *argv[])
         retval = kadm5_modify_principal(handle, &princ, mask);
     }
     if (retval) {
-        com_err("modify_principal", retval, "while modifying \"%s\".", canon);
+        com_err("modify_principal", retval, _("while modifying \"%s\"."),
+                canon);
         goto cleanup;
     }
-    printf("Principal \"%s\" modified.\n", canon);
+    printf(_("Principal \"%s\" modified.\n"), canon);
 cleanup:
     krb5_free_principal(context, kprinc);
     krb5_free_principal(context, princ.principal);
@@ -1403,7 +1433,7 @@ kadmin_getprinc(int argc, char *argv[])
     size_t j;
 
     if (!(argc == 2 || (argc == 3 && !strcmp("-terse", argv[1])))) {
-        fprintf(stderr, "usage: get_principal [-terse] principal\n");
+        fprintf(stderr, _("usage: get_principal [-terse] principal\n"));
         return;
     }
 
@@ -1411,80 +1441,80 @@ kadmin_getprinc(int argc, char *argv[])
 
     retval = kadmin_parse_name(argv[argc - 1], &princ);
     if (retval) {
-        com_err("get_principal", retval, "while parsing principal");
+        com_err("get_principal", retval, _("while parsing principal"));
         return;
     }
     retval = krb5_unparse_name(context, princ, &canon);
     if (retval) {
-        com_err("get_principal", retval, "while canonicalizing principal");
+        com_err("get_principal", retval, _("while canonicalizing principal"));
         goto cleanup;
     }
     retval = kadm5_get_principal(handle, princ, &dprinc,
                                  KADM5_PRINCIPAL_NORMAL_MASK | KADM5_KEY_DATA);
     if (retval) {
-        com_err("get_principal", retval, "while retrieving \"%s\".", canon);
+        com_err("get_principal", retval, _("while retrieving \"%s\"."), canon);
         goto cleanup;
     }
     retval = krb5_unparse_name(context, dprinc.principal, &canon);
     if (retval) {
-        com_err("get_principal", retval, "while canonicalizing principal");
+        com_err("get_principal", retval, _("while canonicalizing principal"));
         goto cleanup;
     }
     retval = krb5_unparse_name(context, dprinc.mod_name, &modcanon);
     if (retval) {
-        com_err("get_principal", retval, "while unparsing modname");
+        com_err("get_principal", retval, _("while unparsing modname"));
         goto cleanup;
     }
     if (argc == 2) {
-        printf("Principal: %s\n", canon);
-        printf("Expiration date: %s\n", dprinc.princ_expire_time ?
-               strdate(dprinc.princ_expire_time) : "[never]");
-        printf("Last password change: %s\n", dprinc.last_pwd_change ?
-               strdate(dprinc.last_pwd_change) : "[never]");
-        printf("Password expiration date: %s\n",
+        printf(_("Principal: %s\n"), canon);
+        printf(_("Expiration date: %s\n"), dprinc.princ_expire_time ?
+               strdate(dprinc.princ_expire_time) : _("[never]"));
+        printf(_("Last password change: %s\n"), dprinc.last_pwd_change ?
+               strdate(dprinc.last_pwd_change) : _("[never]"));
+        printf(_("Password expiration date: %s\n"),
                dprinc.pw_expiration ?
-               strdate(dprinc.pw_expiration) : "[none]");
-        printf("Maximum ticket life: %s\n", strdur(dprinc.max_life));
-        printf("Maximum renewable life: %s\n",
+               strdate(dprinc.pw_expiration) : _("[none]"));
+        printf(_("Maximum ticket life: %s\n"), strdur(dprinc.max_life));
+        printf(_("Maximum renewable life: %s\n"),
                strdur(dprinc.max_renewable_life));
-        printf("Last modified: %s (%s)\n", strdate(dprinc.mod_date), modcanon);
-        printf("Last successful authentication: %s\n",
+        printf(_("Last modified: %s (%s)\n"), strdate(dprinc.mod_date),
+               modcanon);
+        printf(_("Last successful authentication: %s\n"),
                dprinc.last_success ? strdate(dprinc.last_success) :
-               "[never]");
+               _("[never]"));
         printf("Last failed authentication: %s\n",
                dprinc.last_failed ? strdate(dprinc.last_failed) :
                "[never]");
-        printf("Failed password attempts: %d\n",
+        printf(_("Failed password attempts: %d\n"),
                dprinc.fail_auth_count);
-        printf("Number of keys: %d\n", dprinc.n_key_data);
+        printf(_("Number of keys: %d\n"), dprinc.n_key_data);
         for (i = 0; i < dprinc.n_key_data; i++) {
             krb5_key_data *key_data = &dprinc.key_data[i];
             char enctype[BUFSIZ], salttype[BUFSIZ];
 
             if (krb5_enctype_to_name(key_data->key_data_type[0], FALSE,
                                      enctype, sizeof(enctype)))
-                snprintf(enctype, sizeof(enctype), "<Encryption type 0x%x>",
+                snprintf(enctype, sizeof(enctype), _("<Encryption type 0x%x>"),
                          key_data->key_data_type[0]);
             printf("Key: vno %d, %s, ", key_data->key_data_kvno, enctype);
             if (key_data->key_data_ver > 1) {
                 if (krb5_salttype_to_string(key_data->key_data_type[1],
                                             salttype, sizeof(salttype)))
-                    snprintf(salttype, sizeof(salttype), "<Salt type 0x%x>",
+                    snprintf(salttype, sizeof(salttype), _("<Salt type 0x%x>"),
                              key_data->key_data_type[1]);
                 printf("%s\n", salttype);
             } else
-                printf("no salt\n");
+                printf(_("no salt\n"));
         }
-        printf("MKey: vno %d\n",
-               dprinc.mkvno);
+        printf(_("MKey: vno %d\n"), dprinc.mkvno);
 
-        printf("Attributes:");
+        printf(_("Attributes:"));
         for (j = 0; j < sizeof(prflags) / sizeof(char *); j++) {
             if (dprinc.attributes & (krb5_flags) 1 << j)
                 printf(" %s", prflags[j]);
         }
         printf("\n");
-        printf("Policy: %s\n", dprinc.policy ? dprinc.policy : "[none]");
+        printf(_("Policy: %s\n"), dprinc.policy ? dprinc.policy : _("[none]"));
     } else {
         printf("\"%s\"\t%d\t%d\t%d\t%d\t\"%s\"\t%d\t%d\t%d\t%d\t\"%s\""
                "\t%d\t%d\t%d\t%d\t%d",
@@ -1519,12 +1549,12 @@ kadmin_getprincs(int argc, char *argv[])
 
     expr = NULL;
     if (!(argc == 1 || (argc == 2 && (expr = argv[1])))) {
-        fprintf(stderr, "usage: get_principals [expression]\n");
+        fprintf(stderr, _("usage: get_principals [expression]\n"));
         return;
     }
     retval = kadm5_get_principals(handle, expr, &names, &count);
     if (retval) {
-        com_err("get_principals", retval, "while retrieving list.");
+        com_err("get_principals", retval, _("while retrieving list."));
         return;
     }
     for (i = 0; i < count; i++)
@@ -1548,7 +1578,7 @@ kadmin_parse_policy_args(int argc, char *argv[], kadm5_policy_ent_t policy,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -1562,7 +1592,7 @@ kadmin_parse_policy_args(int argc, char *argv[], kadm5_policy_ent_t policy,
             else {
                 date = get_date(argv[i]);
                 if (date == (time_t)-1) {
-                    fprintf(stderr, "Invalid date specification \"%s\".\n",
+                    fprintf(stderr, _("Invalid date specification \"%s\".\n"),
                             argv[i]);
                     return -1;
                 }
@@ -1635,7 +1665,7 @@ kadmin_parse_policy_args(int argc, char *argv[], kadm5_policy_ent_t policy,
             return -1;
     }
     if (i != argc -1) {
-        fprintf(stderr, "%s: parser lost count!\n", caller);
+        fprintf(stderr, _("%s: parser lost count!\n"), caller);
         return -1;
     } else
         return 0;
@@ -1644,10 +1674,13 @@ kadmin_parse_policy_args(int argc, char *argv[], kadm5_policy_ent_t policy,
 static void
 kadmin_addmodpol_usage(char *func)
 {
-    fprintf(stderr, "usage; %s [options] policy\n", func);
-    fprintf(stderr, "\toptions are:\n");
-    fprintf(stderr, "\t\t[-maxlife time] [-minlife time] [-minlength length]\n\t\t[-minclasses number] [-history number]\n\t\t[-maxfailure number] [-failurecountinterval time]\n");
-    fprintf(stderr, "\t\t[-lockoutduration time]\n");
+    fprintf(stderr, _("usage; %s [options] policy\n"), func);
+    fprintf(stderr, _("\toptions are:\n"));
+    fprintf(stderr,
+            _("\t\t[-maxlife time] [-minlife time] [-minlength length]\n"
+              "\t\t[-minclasses number] [-history number]\n"
+              "\t\t[-maxfailure number] [-failurecountinterval time]\n"));
+    fprintf(stderr, _("\t\t[-lockoutduration time]\n"));
 }
 
 void
@@ -1666,7 +1699,7 @@ kadmin_addpol(int argc, char *argv[])
     mask |= KADM5_POLICY;
     retval = kadm5_create_policy(handle, &policy, mask);
     if (retval) {
-        com_err("add_policy", retval, "while creating policy \"%s\".",
+        com_err("add_policy", retval, _("while creating policy \"%s\"."),
                 policy.policy);
     }
 }
@@ -1687,7 +1720,7 @@ kadmin_modpol(int argc, char *argv[])
     policy.policy = argv[argc - 1];
     retval = kadm5_modify_policy(handle, &policy, mask);
     if (retval) {
-        com_err("modify_policy", retval, "while modifying policy \"%s\".",
+        com_err("modify_policy", retval, _("while modifying policy \"%s\"."),
                 policy.policy);
     }
 }
@@ -1699,21 +1732,21 @@ kadmin_delpol(int argc, char *argv[])
     char reply[5];
 
     if (!(argc == 2 || (argc == 3 && !strcmp("-force", argv[1])))) {
-        fprintf(stderr, "usage: delete_policy [-force] policy\n");
+        fprintf(stderr, _("usage: delete_policy [-force] policy\n"));
         return;
     }
     if (argc == 2) {
-        printf("Are you sure you want to delete the policy \"%s\"? (yes/no): ",
-               argv[1]);
+        printf(_("Are you sure you want to delete the policy \"%s\"? "
+                 "(yes/no): "), argv[1]);
         fgets(reply, sizeof(reply), stdin);
         if (strcmp("yes\n", reply)) {
-            fprintf(stderr, "Policy \"%s\" not deleted.\n", argv[1]);
+            fprintf(stderr, _("Policy \"%s\" not deleted.\n"), argv[1]);
             return;
         }
     }
     retval = kadm5_delete_policy(handle, argv[argc - 1]);
     if (retval) {
-        com_err("delete_policy:", retval, "while deleting policy \"%s\"",
+        com_err("delete_policy:", retval, _("while deleting policy \"%s\""),
                 argv[argc - 1]);
     }
 }
@@ -1725,29 +1758,29 @@ kadmin_getpol(int argc, char *argv[])
     kadm5_policy_ent_rec policy;
 
     if (!(argc == 2 || (argc == 3 && !strcmp("-terse", argv[1])))) {
-        fprintf(stderr, "usage: get_policy [-terse] policy\n");
+        fprintf(stderr, _("usage: get_policy [-terse] policy\n"));
         return;
     }
     retval = kadm5_get_policy(handle, argv[argc - 1], &policy);
     if (retval) {
-        com_err("get_policy", retval, "while retrieving policy \"%s\".",
+        com_err("get_policy", retval, _("while retrieving policy \"%s\"."),
                 argv[argc - 1]);
         return;
     }
     if (argc == 2) {
-        printf("Policy: %s\n", policy.policy);
-        printf("Maximum password life: %ld\n", policy.pw_max_life);
-        printf("Minimum password life: %ld\n", policy.pw_min_life);
-        printf("Minimum password length: %ld\n", policy.pw_min_length);
-        printf("Minimum number of password character classes: %ld\n",
+        printf(_("Policy: %s\n"), policy.policy);
+        printf(_("Maximum password life: %ld\n"), policy.pw_max_life);
+        printf(_("Minimum password life: %ld\n"), policy.pw_min_life);
+        printf(_("Minimum password length: %ld\n"), policy.pw_min_length);
+        printf(_("Minimum number of password character classes: %ld\n"),
                policy.pw_min_classes);
-        printf("Number of old keys kept: %ld\n", policy.pw_history_num);
-        printf("Reference count: %ld\n", policy.policy_refcnt);
-        printf("Maximum password failures before lockout: %lu\n",
+        printf(_("Number of old keys kept: %ld\n"), policy.pw_history_num);
+        printf(_("Reference count: %ld\n"), policy.policy_refcnt);
+        printf(_("Maximum password failures before lockout: %lu\n"),
                (unsigned long)policy.pw_max_fail);
-        printf("Password failure count reset interval: %s\n",
+        printf(_("Password failure count reset interval: %s\n"),
                strdur(policy.pw_failcnt_interval));
-        printf("Password lockout duration: %s\n",
+        printf(_("Password lockout duration: %s\n"),
                strdur(policy.pw_lockout_duration));
     } else {
         printf("\"%s\"\t%ld\t%ld\t%ld\t%ld\t%ld\t%ld\t%lu\t%ld\t%ld\n",
@@ -1770,12 +1803,12 @@ kadmin_getpols(int argc, char *argv[])
 
     expr = NULL;
     if (!(argc == 1 || (argc == 2 && (expr = argv[1])))) {
-        fprintf(stderr, "usage: get_policies [expression]\n");
+        fprintf(stderr, _("usage: get_policies [expression]\n"));
         return;
     }
     retval = kadm5_get_policies(handle, expr, &names, &count);
     if (retval) {
-        com_err("get_policies", retval, "while retrieving list.");
+        com_err("get_policies", retval, _("while retrieving list."));
         return;
     }
     for (i = 0; i < count; i++)
@@ -1792,15 +1825,15 @@ kadmin_getprivs(int argc, char *argv[])
     long plist;
 
     if (argc != 1) {
-        fprintf(stderr, "usage: get_privs\n");
+        fprintf(stderr, _("usage: get_privs\n"));
         return;
     }
     retval = kadm5_get_privs(handle, &plist);
     if (retval) {
-        com_err("get_privs", retval, "while retrieving privileges");
+        com_err("get_privs", retval, _("while retrieving privileges"));
         return;
     }
-    printf("current privileges:");
+    printf(_("current privileges:"));
     for (i = 0; i < sizeof (privs) / sizeof (char *); i++) {
         if (plist & 1 << i)
             printf(" %s", privs[i]);
@@ -1824,31 +1857,31 @@ kadmin_purgekeys(int argc, char *argv[])
         pname = argv[1];
     }
     if (pname == NULL) {
-        fprintf(stderr, "usage: purgekeys [-keepkvno oldest_kvno_to_keep] "
-                "principal\n");
+        fprintf(stderr, _("usage: purgekeys [-keepkvno oldest_kvno_to_keep] "
+                          "principal\n"));
         return;
     }
 
     retval = kadmin_parse_name(pname, &princ);
     if (retval) {
-        com_err("purgekeys", retval, "while parsing principal");
+        com_err("purgekeys", retval, _("while parsing principal"));
         return;
     }
 
     retval = krb5_unparse_name(context, princ, &canon);
     if (retval) {
-        com_err("purgekeys", retval, "while canonicalizing principal");
+        com_err("purgekeys", retval, _("while canonicalizing principal"));
         goto cleanup;
     }
 
     retval = kadm5_purgekeys(handle, princ, keepkvno);
     if (retval) {
         com_err("purgekeys", retval,
-                "while purging keys for principal \"%s\"", canon);
+                _("while purging keys for principal \"%s\""), canon);
         goto cleanup;
     }
 
-    printf("Old keys for principal \"%s\" purged.\n", canon);
+    printf(_("Old keys for principal \"%s\" purged.\n"), canon);
 cleanup:
     krb5_free_principal(context, princ);
     free(canon);
diff --git a/src/kadmin/cli/keytab.c b/src/kadmin/cli/keytab.c
index d3c4a66a9b..2af8202837 100644
--- a/src/kadmin/cli/keytab.c
+++ b/src/kadmin/cli/keytab.c
@@ -64,16 +64,19 @@ static void
 add_usage()
 {
 #ifdef KADMIN_LOCAL
-    fprintf(stderr, "Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] [-norandkey] [principal | -glob princ-exp] [...]\n");
+    fprintf(stderr, _("Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] "
+                      "[-norandkey] [principal | -glob princ-exp] [...]\n"));
 #else
-    fprintf(stderr, "Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] [principal | -glob princ-exp] [...]\n");
+    fprintf(stderr, _("Usage: ktadd [-k[eytab] keytab] [-q] [-e keysaltlist] "
+                      "[principal | -glob princ-exp] [...]\n"));
 #endif
 }
 
 static void
 rem_usage()
 {
-    fprintf(stderr, "Usage: ktremove [-k[eytab] keytab] [-q] principal [kvno|\"all\"|\"old\"]\n");
+    fprintf(stderr, _("Usage: ktremove [-k[eytab] keytab] [-q] principal "
+                      "[kvno|\"all\"|\"old\"]\n"));
 }
 
 static int
@@ -86,18 +89,18 @@ process_keytab(krb5_context my_context, char **keytab_str,
     if (name == NULL) {
         name = malloc(BUFSIZ);
         if (!name) {
-            com_err(whoami, ENOMEM, "while creating keytab name");
+            com_err(whoami, ENOMEM, _("while creating keytab name"));
             return 1;
         }
         code = krb5_kt_default(my_context, keytab);
         if (code != 0) {
-            com_err(whoami, code, "while opening default keytab");
+            com_err(whoami, code, _("while opening default keytab"));
             free(name);
             return 1;
         }
         code = krb5_kt_get_name(my_context, *keytab, name, BUFSIZ);
         if (code != 0) {
-            com_err(whoami, code, "while getting keytab name");
+            com_err(whoami, code, _("while getting keytab name"));
             free(name);
             return 1;
         }
@@ -107,13 +110,13 @@ process_keytab(krb5_context my_context, char **keytab_str,
         else if (asprintf(&name, "WRFILE:%s", name) < 0)
             name = NULL;
         if (name == NULL) {
-            com_err(whoami, ENOMEM, "while creating keytab name");
+            com_err(whoami, ENOMEM, _("while creating keytab name"));
             return 1;
         }
 
         code = krb5_kt_resolve(my_context, name, keytab);
         if (code != 0) {
-            com_err(whoami, code, "while resolving keytab %s", name);
+            com_err(whoami, code, _("while resolving keytab %s"), name);
             free(name);
             return 1;
         }
@@ -162,7 +165,7 @@ kadmin_keytab_add(int argc, char **argv)
             retval = krb5_string_to_keysalts(*++argv, ", \t", ":.-", 0,
                                              &ks_tuple, &n_ks_tuple);
             if (retval) {
-                com_err("ktadd", retval, "while parsing keysalts %s",
+                com_err("ktadd", retval, _("while parsing keysalts %s"),
                         *argv);
 
                 return;
@@ -179,7 +182,8 @@ kadmin_keytab_add(int argc, char **argv)
 
 #ifdef KADMIN_LOCAL
     if (norandkey && ks_tuple) {
-        fprintf(stderr, "cannot specify keysaltlist when not changing key\n");
+        fprintf(stderr,
+                _("cannot specify keysaltlist when not changing key\n"));
         return;
     }
 #endif
@@ -196,7 +200,7 @@ kadmin_keytab_add(int argc, char **argv)
 
             code = kadm5_get_principals(handle, *argv, &princs, &num);
             if (code) {
-                com_err(whoami, code, "while expanding expression \"%s\".",
+                com_err(whoami, code, _("while expanding expression \"%s\"."),
                         *argv);
                 argv++;
                 continue;
@@ -215,7 +219,7 @@ kadmin_keytab_add(int argc, char **argv)
 
     code = krb5_kt_close(context, keytab);
     if (code != 0)
-        com_err(whoami, code, "while closing keytab");
+        com_err(whoami, code, _("while closing keytab"));
 
     free(keytab_str);
 }
@@ -255,7 +259,7 @@ kadmin_keytab_remove(int argc, char **argv)
 
     code = krb5_kt_close(context, keytab);
     if (code != 0)
-        com_err(whoami, code, "while closing keytab");
+        com_err(whoami, code, _("while closing keytab"));
 
     free(keytab_str);
 }
@@ -279,7 +283,7 @@ add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
 
     code = krb5_parse_name(context, princ_str, &princ);
     if (code != 0) {
-        com_err(whoami, code, "while parsing -add principal name %s",
+        com_err(whoami, code, _("while parsing -add principal name %s"),
                 princ_str);
         goto cleanup;
     }
@@ -296,17 +300,17 @@ add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
             code = kadm5_randkey_principal(lhandle, princ, &keys, &nkeys);
     if (code != 0) {
         if (code == KADM5_UNK_PRINC) {
-            fprintf(stderr, "%s: Principal %s does not exist.\n",
+            fprintf(stderr, _("%s: Principal %s does not exist.\n"),
                     whoami, princ_str);
         } else
-            com_err(whoami, code, "while changing %s's key", princ_str);
+            com_err(whoami, code, _("while changing %s's key"), princ_str);
         goto cleanup;
     }
 
     code = kadm5_get_principal(lhandle, princ, &princ_rec,
                                KADM5_PRINCIPAL_NORMAL_MASK);
     if (code != 0) {
-        com_err(whoami, code, "while retrieving principal");
+        com_err(whoami, code, _("while retrieving principal"));
         goto cleanup;
     }
 
@@ -318,14 +322,14 @@ add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
 
         code = krb5_kt_add_entry(context, keytab, &new_entry);
         if (code != 0) {
-            com_err(whoami, code, "while adding key to keytab");
+            com_err(whoami, code, _("while adding key to keytab"));
             kadm5_free_principal_ent(lhandle, &princ_rec);
             goto cleanup;
         }
 
         if (!quiet) {
-            printf("Entry for principal %s with kvno %d, "
-                   "encryption type %s added to keytab %s.\n",
+            printf(_("Entry for principal %s with kvno %d, "
+                     "encryption type %s added to keytab %s.\n"),
                    princ_str, princ_rec.kvno,
                    etype_string(keys[i].enctype), keytab_str);
         }
@@ -333,7 +337,7 @@ add_principal(void *lhandle, char *keytab_str, krb5_keytab keytab,
 
     code = kadm5_free_principal_ent(lhandle, &princ_rec);
     if (code != 0) {
-        com_err(whoami, code, "while freeing principal entry");
+        com_err(whoami, code, _("while freeing principal entry"));
         goto cleanup;
     }
 
@@ -357,7 +361,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
 
     code = krb5_parse_name(context, princ_str, &princ);
     if (code != 0) {
-        com_err(whoami, code, "while parsing principal name %s", princ_str);
+        com_err(whoami, code, _("while parsing principal name %s"), princ_str);
         return;
     }
 
@@ -380,20 +384,22 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
     code = krb5_kt_get_entry(context, keytab, princ, kvno, 0, &entry);
     if (code != 0) {
         if (code == ENOENT) {
-            fprintf(stderr, "%s: Keytab %s does not exist.\n",
+            fprintf(stderr, _("%s: Keytab %s does not exist.\n"),
                     whoami, keytab_str);
         } else if (code == KRB5_KT_NOTFOUND) {
             if (mode != SPEC) {
-                fprintf(stderr, "%s: No entry for principal "
-                        "%s exists in keytab %s\n",
+                fprintf(stderr, _("%s: No entry for principal %s exists in "
+                                  "keytab %s\n"),
                         whoami, princ_str, keytab_str);
             } else {
-                fprintf(stderr, "%s: No entry for principal "
-                        "%s with kvno %d exists in keytab "
-                        "%s.\n", whoami, princ_str, kvno, keytab_str);
+                fprintf(stderr, _("%s: No entry for principal %s with kvno %d "
+                                  "exists in keytab %s\n"),
+                        whoami, princ_str, kvno, keytab_str);
             }
-        } else
-            com_err(whoami, code, "while retrieving highest kvno from keytab");
+        } else {
+            com_err(whoami, code,
+                    _("while retrieving highest kvno from keytab"));
+        }
         return;
     }
 
@@ -404,7 +410,7 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
 
     code = krb5_kt_start_seq_get(context, keytab, &cursor);
     if (code != 0) {
-        com_err(whoami, code, "while starting keytab scan");
+        com_err(whoami, code, _("while starting keytab scan"));
         return;
     }
 
@@ -424,35 +430,36 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
              */
             code = krb5_kt_end_seq_get(context, keytab, &cursor);
             if (code != 0) {
-                com_err(whoami, code, "while temporarily ending keytab scan");
+                com_err(whoami, code,
+                        _("while temporarily ending keytab scan"));
                 return;
             }
             code = krb5_kt_remove_entry(context, keytab, &entry);
             if (code != 0) {
-                com_err(whoami, code, "while deleting entry from keytab");
+                com_err(whoami, code, _("while deleting entry from keytab"));
                 return;
             }
             code = krb5_kt_start_seq_get(context, keytab, &cursor);
             if (code != 0) {
-                com_err(whoami, code, "while restarting keytab scan");
+                com_err(whoami, code, _("while restarting keytab scan"));
                 return;
             }
 
             did_something++;
-            if (!quiet)
-                printf("Entry for principal %s with kvno %d "
-                       "removed from keytab %s.\n",
-                       princ_str, entry.vno, keytab_str);
+            if (!quiet) {
+                printf(_("Entry for principal %s with kvno %d removed from "
+                         "keytab %s.\n"), princ_str, entry.vno, keytab_str);
+            }
         }
         krb5_kt_free_entry(context, &entry);
     }
     if (code && code != KRB5_KT_END) {
-        com_err(whoami, code, "while scanning keytab");
+        com_err(whoami, code, _("while scanning keytab"));
         return;
     }
     code = krb5_kt_end_seq_get(context, keytab, &cursor);
     if (code) {
-        com_err(whoami, code, "while ending keytab scan");
+        com_err(whoami, code, _("while ending keytab scan"));
         return;
     }
 
@@ -462,8 +469,8 @@ remove_principal(char *keytab_str, krb5_keytab keytab,
      * prevent unexpected error messages...
      */
     if (!did_something && mode == OLD) {
-        fprintf(stderr, "%s: There is only one entry for principal "
-                "%s in keytab %s\n", whoami, princ_str, keytab_str);
+        fprintf(stderr, _("%s: There is only one entry for principal %s in "
+                          "keytab %s\n"), whoami, princ_str, keytab_str);
     }
 }
 
diff --git a/src/kadmin/cli/ss_wrapper.c b/src/kadmin/cli/ss_wrapper.c
index 249a9b4b14..bde9b15612 100644
--- a/src/kadmin/cli/ss_wrapper.c
+++ b/src/kadmin/cli/ss_wrapper.c
@@ -24,9 +24,8 @@
  */
 
 #include <krb5.h>
+#include <k5-platform.h>
 #include <ss/ss.h>
-#include <stdio.h>
-#include <string.h>
 #include "kadmin.h"
 
 extern ss_request_table kadmin_cmds;
@@ -45,7 +44,7 @@ main(int argc, char *argv[])
     request = kadmin_startup(argc, argv);
     sci_idx = ss_create_invocation(whoami, "5.0", NULL, &kadmin_cmds, &retval);
     if (retval) {
-        ss_perror(sci_idx, retval, "creating invocation");
+        ss_perror(sci_idx, retval, _("creating invocation"));
         exit(1);
     }
     if (request) {
diff --git a/src/kadmin/dbutil/dump.c b/src/kadmin/dbutil/dump.c
index 2c646889de..39bfe00c43 100644
--- a/src/kadmin/dbutil/dump.c
+++ b/src/kadmin/dbutil/dump.c
@@ -210,53 +210,53 @@ extern krb5_db_entry      *master_entry;
 static const char null_mprinc_name[] = "kdb5_dump@MISSING";
 
 /* Message strings */
-#define regex_err               "%s: regular expression error - %s\n"
-#define regex_merr              "%s: regular expression match error - %s\n"
-#define pname_unp_err           "%s: cannot unparse principal name (%s)\n"
-#define mname_unp_err           "%s: cannot unparse modifier name (%s)\n"
-#define nokeys_err              "%s: cannot find any standard key for %s\n"
-#define sdump_tl_inc_err        "%s: tagged data list inconsistency for %s (counted %d, stored %d)\n"
-#define ofopen_error            "%s: cannot open %s for writing (%s)\n"
-#define oflock_error            "%s: cannot lock %s (%s)\n"
-#define dumprec_err             "%s: error performing %s dump (%s)\n"
-#define trash_end_fmt           "%s(%d): ignoring trash at end of line: "
-#define read_name_string        "name string"
-#define read_key_type           "key type"
-#define read_key_data           "key data"
-#define read_pr_data1           "first set of principal attributes"
-#define read_mod_name           "modifier name"
-#define read_pr_data2           "second set of principal attributes"
-#define read_salt_data          "salt data"
-#define read_akey_type          "alternate key type"
-#define read_akey_data          "alternate key data"
-#define read_asalt_type         "alternate salt type"
-#define read_asalt_data         "alternate salt data"
-#define read_exp_data           "expansion data"
-#define store_err_fmt           "%s(%d): cannot store %s(%s)\n"
-#define add_princ_fmt           "%s\n"
-#define parse_err_fmt           "%s(%d): cannot parse %s (%s)\n"
-#define read_err_fmt            "%s(%d): cannot read %s\n"
-#define no_mem_fmt              "%s(%d): no memory for buffers\n"
-#define rhead_err_fmt           "%s(%d): cannot match size tokens\n"
-#define err_line_fmt            "%s: error processing line %d of %s\n"
-#define head_bad_fmt            "%s: dump header bad in %s\n"
-#define read_nint_data          "principal static attributes"
-#define read_tcontents          "tagged data contents"
-#define read_ttypelen           "tagged data type and length"
-#define read_kcontents          "key data contents"
-#define read_ktypelen           "key data type and length"
-#define read_econtents          "extra data contents"
-#define no_name_mem_fmt         "%s: cannot get memory for temporary name\n"
-#define ctx_err_fmt             "%s: cannot initialize Kerberos context\n"
-#define stdin_name              "standard input"
-#define remaster_err_fmt        "while re-encoding keys for principal %s with new master key"
-#define restfail_fmt            "%s: %s restore failed\n"
-#define close_err_fmt           "%s: cannot close database (%s)\n"
-#define dbinit_err_fmt          "%s: cannot initialize database (%s)\n"
-#define dbdelerr_fmt            "%s: cannot delete bad database %s (%s)\n"
-#define dbunlockerr_fmt         "%s: cannot unlock database %s (%s)\n"
-#define dbcreaterr_fmt          "%s: cannot create database %s (%s)\n"
-#define dfile_err_fmt           "%s: cannot open %s (%s)\n"
+#define regex_err         _("%s: regular expression error - %s\n")
+#define regex_merr        _("%s: regular expression match error - %s\n")
+#define pname_unp_err     _("%s: cannot unparse principal name (%s)\n")
+#define mname_unp_err     _("%s: cannot unparse modifier name (%s)\n")
+#define nokeys_err        _("%s: cannot find any standard key for %s\n")
+#define sdump_tl_inc_err  _("%s: tagged data list inconsistency for %s (counted %d, stored %d)\n")
+#define ofopen_error      _("%s: cannot open %s for writing (%s)\n")
+#define oflock_error      _("%s: cannot lock %s (%s)\n")
+#define dumprec_err       _("%s: error performing %s dump (%s)\n")
+#define trash_end_fmt     _("%s(%d): ignoring trash at end of line: ")
+#define read_name_string  _("name string")
+#define read_key_type     _("key type")
+#define read_key_data     _("key data")
+#define read_pr_data1     _("first set of principal attributes")
+#define read_mod_name     _("modifier name")
+#define read_pr_data2     _("second set of principal attributes")
+#define read_salt_data    _("salt data")
+#define read_akey_type    _("alternate key type")
+#define read_akey_data    _("alternate key data")
+#define read_asalt_type   _("alternate salt type")
+#define read_asalt_data   _("alternate salt data")
+#define read_exp_data     _("expansion data")
+#define store_err_fmt     _("%s(%d): cannot store %s(%s)\n")
+#define add_princ_fmt     _("%s\n")
+#define parse_err_fmt     _("%s(%d): cannot parse %s (%s)\n")
+#define read_err_fmt      _("%s(%d): cannot read %s\n")
+#define no_mem_fmt        _("%s(%d): no memory for buffers\n")
+#define rhead_err_fmt     _("%s(%d): cannot match size tokens\n")
+#define err_line_fmt      _("%s: error processing line %d of %s\n")
+#define head_bad_fmt      _("%s: dump header bad in %s\n")
+#define read_nint_data    _("principal static attributes")
+#define read_tcontents    _("tagged data contents")
+#define read_ttypelen     _("tagged data type and length")
+#define read_kcontents    _("key data contents")
+#define read_ktypelen     _("key data type and length")
+#define read_econtents    _("extra data contents")
+#define no_name_mem_fmt   _("%s: cannot get memory for temporary name\n")
+#define ctx_err_fmt       _("%s: cannot initialize Kerberos context\n")
+#define stdin_name        _("standard input")
+#define remaster_err_fmt  _("while re-encoding keys for principal %s with new master key")
+#define restfail_fmt      _("%s: %s restore failed\n")
+#define close_err_fmt     _("%s: cannot close database (%s)\n")
+#define dbinit_err_fmt    _("%s: cannot initialize database (%s)\n")
+#define dbdelerr_fmt      _("%s: cannot delete bad database %s (%s)\n")
+#define dbunlockerr_fmt   _("%s: cannot unlock database %s (%s)\n")
+#define dbcreaterr_fmt    _("%s: cannot create database %s (%s)\n")
+#define dfile_err_fmt     _("%s: cannot open %s (%s)\n")
 
 static const char oldoption[] = "-old";
 static const char b6option[] = "-b6";
@@ -342,19 +342,19 @@ void update_ok_file (file_name)
 
     if (asprintf(&file_ok, "%s%s", file_name, ok) < 0) {
         com_err(progname, ENOMEM,
-                "while allocating filename for update_ok_file");
+                _("while allocating filename for update_ok_file"));
         exit_status++;
         return;
     }
     if ((fd = open(file_ok, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
-        com_err(progname, errno, "while creating 'ok' file, '%s'",
+        com_err(progname, errno, _("while creating 'ok' file, '%s'"),
                 file_ok);
         exit_status++;
         free(file_ok);
         return;
     }
     if (write(fd, "", 1) != 1) {
-        com_err(progname, errno, "while writing to 'ok' file, '%s'",
+        com_err(progname, errno, _("while writing to 'ok' file, '%s'"),
                 file_ok);
         exit_status++;
         free(file_ok);
@@ -1034,8 +1034,8 @@ static krb5_error_code dump_ov_princ(krb5_pointer ptr, krb5_db_entry *kdb)
             if (key_data->key_data_type[0] != ENCTYPE_DES_CBC_CRC)
                 continue;
             if (foundcrc) {
-                fprintf(stderr, "Warning!  Multiple DES-CBC-CRC keys "
-                        "for principal %s; skipping duplicates.\n",
+                fprintf(stderr, _("Warning!  Multiple DES-CBC-CRC keys for "
+                                  "principal %s; skipping duplicates.\n"),
                         princstr);
                 continue;
             }
@@ -1044,10 +1044,11 @@ static krb5_error_code dump_ov_princ(krb5_pointer ptr, krb5_db_entry *kdb)
             fputc('\t', arg->ofile);
             print_key_data(arg->ofile, key_data);
         }
-        if (!foundcrc)
-            fprintf(stderr, "Warning!  No DES-CBC-CRC key for principal "
-                    "%s, cannot generate OV-compatible record; skipping\n",
-                    princstr);
+        if (!foundcrc) {
+            fprintf(stderr, _("Warning!  No DES-CBC-CRC key for principal %s, "
+                              "cannot generate OV-compatible record; "
+                              "skipping\n"), princstr);
+        }
     }
 
     fputc('\n', arg->ofile);
@@ -1159,7 +1160,7 @@ dump_db(argc, argv)
      * to be opened if we try a dump that uses it.
      */
     if (!dbactive) {
-        com_err(progname, 0, "Database not currently opened!");
+        com_err(progname, 0, _("Database not currently opened!"));
         exit_status++;
         return;
     }
@@ -1178,16 +1179,14 @@ dump_db(argc, argv)
                                         NULL, NULL,
                                         &master_keyblock);
             if (retval) {
-                com_err(progname, retval,
-                        "while reading master key");
+                com_err(progname, retval, _("while reading master key"));
                 exit(1);
             }
             retval = krb5_db_fetch_mkey_list(util_context, master_princ,
                                              &master_keyblock, IGNORE_VNO,
                                              &mkeys);
             if (retval) {
-                com_err(progname, retval,
-                        "while verifying master key");
+                com_err(progname, retval, _("while verifying master key"));
                 exit(1);
             }
             krb5_db_free_mkey_list(util_context, mkeys);
@@ -1212,18 +1211,18 @@ dump_db(argc, argv)
                                              &kt_kvno,
                                              NULL,
                                              &new_master_keyblock))) {
-                com_err(progname, retval, "while reading new master key");
+                com_err(progname, retval, _("while reading new master key"));
                 exit(1);
             }
         } else {
-            printf("Please enter new master key....\n");
+            printf(_("Please enter new master key....\n"));
             if ((retval = krb5_db_fetch_mkey(util_context, master_princ,
                                              new_master_keyblock.enctype,
                                              TRUE,
                                              TRUE,
                                              NULL, NULL, NULL,
                                              &new_master_keyblock))) {
-                com_err(progname, retval, "while reading new master key");
+                com_err(progname, retval, _("while reading new master key"));
                 exit(1);
             }
         }
@@ -2112,7 +2111,7 @@ process_k5beta7_policy(fname, kcontext, filep, flags, linenop)
     if (nread == EOF)
         return -1;
     else if (nread != 7) {
-        fprintf(stderr, "cannot parse policy on line %d (%d read)\n",
+        fprintf(stderr, _("cannot parse policy on line %d (%d read)\n"),
                 *linenop, nread);
         return 1;
     }
@@ -2120,13 +2119,13 @@ process_k5beta7_policy(fname, kcontext, filep, flags, linenop)
     if ((ret = krb5_db_create_policy(kcontext, &rec))) {
         if (ret &&
             ((ret = krb5_db_put_policy(kcontext, &rec)))) {
-            fprintf(stderr, "cannot create policy on line %d: %s\n",
+            fprintf(stderr, _("cannot create policy on line %d: %s\n"),
                     *linenop, error_message(ret));
             return 1;
         }
     }
     if (flags & FLAG_VERBOSE)
-        fprintf(stderr, "created policy %s\n", rec.name);
+        fprintf(stderr, _("created policy %s\n"), rec.name);
 
     return 0;
 }
@@ -2209,7 +2208,7 @@ process_k5beta7_record(fname, kcontext, filep, flags, linenop)
         process_k5beta7_policy(fname, kcontext, filep, flags,
                                linenop);
     else {
-        fprintf(stderr, "unknown record type \"%s\" on line %d\n",
+        fprintf(stderr, _("unknown record type \"%s\" on line %d\n"),
                 rectype, *linenop);
         return 1;
     }
@@ -2247,7 +2246,7 @@ process_ov_record(fname, kcontext, filep, flags, linenop)
     else if (strcmp(rectype, "End") == 0)
         return -1;
     else {
-        fprintf(stderr, "unknown record type \"%s\" on line %d\n",
+        fprintf(stderr, _("unknown record type \"%s\" on line %d\n"),
                 rectype, *linenop);
         return 1;
     }
@@ -2283,7 +2282,7 @@ process_r1_8_record(fname, kcontext, filep, flags, linenop)
         process_r1_8_policy(fname, kcontext, filep, flags,
                             linenop);
     else {
-        fprintf(stderr, "unknown record type \"%s\" on line %d\n",
+        fprintf(stderr, _("unknown record type \"%s\" on line %d\n"),
                 rectype, *linenop);
         return 1;
     }
@@ -2390,7 +2389,8 @@ load_db(argc, argv)
             flags |= FLAG_UPDATE;
         else if (!strcmp(argv[aindex], hashoption)) {
             if (!add_db_arg("hash=true")) {
-                com_err(progname, ENOMEM, "while parsing command arguments\n");
+                com_err(progname, ENOMEM,
+                        _("while parsing command arguments\n"));
                 exit(1);
             }
         } else
@@ -2413,7 +2413,7 @@ load_db(argc, argv)
 
     if( (kret = krb5_set_default_realm(kcontext, util_context->default_realm)) )
     {
-        fprintf(stderr, "%s: Unable to set the default realm\n", progname);
+        fprintf(stderr, _("%s: Unable to set the default realm\n"), progname);
         exit_status++;
         return;
     }
@@ -2433,7 +2433,7 @@ load_db(argc, argv)
         }
         if ((kret = krb5_lock_file(kcontext, fileno(f),
                                    KRB5_LOCKMODE_SHARED))) {
-            fprintf(stderr, "%s: Cannot lock %s: %s\n", progname,
+            fprintf(stderr, _("%s: Cannot lock %s: %s\n"), progname,
                     dumpfile, error_message(errno));
             exit_status++;
             return;
@@ -2478,8 +2478,8 @@ load_db(argc, argv)
         }
     }
     if (load->updateonly && !(flags & FLAG_UPDATE)) {
-        fprintf(stderr, "%s: dump version %s can only be loaded with the "
-                "-update flag\n", progname, load->name);
+        fprintf(stderr, _("%s: dump version %s can only be loaded with the "
+                          "-update flag\n"), progname, load->name);
         exit_status++;
         return;
     }
@@ -2491,12 +2491,12 @@ load_db(argc, argv)
      */
     if (! (flags & FLAG_UPDATE)) {
         if (!add_db_arg("temporary")) {
-            com_err(progname, ENOMEM, "computing parameters for database");
+            com_err(progname, ENOMEM, _("computing parameters for database"));
             exit(1);
         }
 
         if (!add_update && !add_db_arg("merge_nra")) {
-            com_err(progname, ENOMEM, "computing parameters for database");
+            com_err(progname, ENOMEM, _("computing parameters for database"));
             exit(1);
         }
 
@@ -2527,7 +2527,7 @@ load_db(argc, argv)
         if (kret == 0)
             db_locked = 1;
         else if (kret != KRB5_PLUGIN_OP_NOTSUPP) {
-            fprintf(stderr, "%s: %s while permanently locking database\n",
+            fprintf(stderr, _("%s: %s while permanently locking database\n"),
                     progname, error_message(kret));
             exit_status++;
             goto error;
@@ -2639,8 +2639,8 @@ load_db(argc, argv)
          * anyway.
          */
         if (kret != 0 && kret != KRB5_PLUGIN_OP_NOTSUPP) {
-            fprintf(stderr, "%s: cannot make newly loaded database live (%s)\n",
-                    progname, error_message(kret));
+            fprintf(stderr, _("%s: cannot make newly loaded database live "
+                              "(%s)\n"), progname, error_message(kret));
             exit_status++;
         }
     }
diff --git a/src/kadmin/dbutil/kadm5_create.c b/src/kadmin/dbutil/kadm5_create.c
index c086adf75b..65cd68be5d 100644
--- a/src/kadmin/dbutil/kadm5_create.c
+++ b/src/kadmin/dbutil/kadm5_create.c
@@ -84,7 +84,8 @@ int kadm5_create(kadm5_config_params *params)
      */
     if ((retval = kadm5_get_config_params(context, 1,
                                           params, &lparams))) {
-        com_err(progname, retval, "while looking up the Kerberos configuration");
+        com_err(progname, retval, _("while looking up the Kerberos "
+                                    "configuration"));
         return 1;
     }
 
@@ -110,7 +111,8 @@ int kadm5_create_magic_princs(kadm5_config_params *params,
                              KADM5_API_VERSION_3,
                              db5util_db_args,
                              &handle))) {
-        com_err(progname, retval, "while initializing the Kerberos admin interface");
+        com_err(progname, retval, _("while initializing the Kerberos admin "
+                                    "interface"));
         return retval;
     }
 
@@ -192,9 +194,8 @@ static int add_admin_princs(void *handle, krb5_context context, char *realm)
     }
     if (ai->ai_canonname == NULL) {
         ret = EINVAL;
-        fprintf(stderr,
-                "getaddrinfo(%s): Cannot determine canonical hostname.\n",
-                localname);
+        fprintf(stderr, _("getaddrinfo(%s): Cannot determine canonical "
+                          "hostname.\n"), localname);
         freeaddrinfo(ai);
         goto clean_and_exit;
     }
@@ -214,7 +215,7 @@ static int add_admin_princs(void *handle, krb5_context context, char *realm)
     }
     if (asprintf(&service_name, "kadmin/%s", ai->ai_canonname) < 0) {
         ret = ENOMEM;
-        fprintf(stderr, "Out of memory\n");
+        fprintf(stderr, _("Out of memory\n"));
         freeaddrinfo(ai);
         goto clean_and_exit;
     }
@@ -286,7 +287,7 @@ int add_admin_princ(void *handle, krb5_context context,
     fullname = build_name_with_realm(name, realm);
     ret = krb5_parse_name(context, fullname, &ent.principal);
     if (ret) {
-        com_err(progname, ret, "while parsing admin principal name");
+        com_err(progname, ret, _("while parsing admin principal name"));
         return(ERR);
     }
     ent.max_life = lifetime;
@@ -298,7 +299,7 @@ int add_admin_princ(void *handle, krb5_context context,
                                  "to-be-random");
     if (ret) {
         if (ret != KADM5_DUP) {
-            com_err(progname, ret, "while creating principal %s", fullname);
+            com_err(progname, ret, _("while creating principal %s"), fullname);
             krb5_free_principal(context, ent.principal);
             free(fullname);
             return ERR;
@@ -307,7 +308,8 @@ int add_admin_princ(void *handle, krb5_context context,
         /* only randomize key if we created the principal */
         ret = kadm5_randkey_principal(handle, ent.principal, NULL, NULL);
         if (ret) {
-            com_err(progname, ret, "while randomizing principal %s", fullname);
+            com_err(progname, ret, _("while randomizing principal %s"),
+                    fullname);
             krb5_free_principal(context, ent.principal);
             free(fullname);
             return ERR;
@@ -316,7 +318,8 @@ int add_admin_princ(void *handle, krb5_context context,
         ent.attributes = attrs;
         ret = kadm5_modify_principal(handle, &ent, KADM5_ATTRIBUTES);
         if (ret) {
-            com_err(progname, ret, "while setting attributes on %s", fullname);
+            com_err(progname, ret, _("while setting attributes on %s"),
+                    fullname);
             krb5_free_principal(context, ent.principal);
             free(fullname);
             return ERR;
diff --git a/src/kadmin/dbutil/kdb5_create.c b/src/kadmin/dbutil/kdb5_create.c
index 0d41b5f736..b34219b08e 100644
--- a/src/kadmin/dbutil/kdb5_create.c
+++ b/src/kadmin/dbutil/kdb5_create.c
@@ -172,7 +172,8 @@ void kdb5_create(argc, argv)
             break;
         case 'h':
             if (!add_db_arg("hash=true")) {
-                com_err(progname, ENOMEM, "while parsing command arguments\n");
+                com_err(progname, ENOMEM,
+                        _("while parsing command arguments\n"));
                 exit(1);
             }
             break;
@@ -195,10 +196,10 @@ void kdb5_create(argc, argv)
 
     log_ctx = util_context->kdblog_context;
 
-    printf ("Loading random data\n");
+    printf(_("Loading random data\n"));
     retval = krb5_c_random_os_entropy (util_context, strong_random, NULL);
     if (retval) {
-        com_err (progname, retval, "Loading random data");
+        com_err(progname, retval, _("Loading random data"));
         exit_status++; return;
     }
 
@@ -208,7 +209,7 @@ void kdb5_create(argc, argv)
                                           global_params.mkey_name,
                                           global_params.realm,
                                           &mkey_fullname, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++; return;
     }
 
@@ -219,26 +220,27 @@ void kdb5_create(argc, argv)
     krb5_princ_component(util_context, &tgt_princ,1)->data = global_params.realm;
     krb5_princ_component(util_context, &tgt_princ,1)->length = strlen(global_params.realm);
 
-    printf("Initializing database '%s' for realm '%s',\n\
-master key name '%s'\n",
+    printf(_("Initializing database '%s' for realm '%s',\n"
+             "master key name '%s'\n"),
            global_params.dbname, global_params.realm, mkey_fullname);
 
     if (!mkey_password) {
-        printf("You will be prompted for the database Master Password.\n");
-        printf("It is important that you NOT FORGET this password.\n");
+        printf(_("You will be prompted for the database Master Password.\n"));
+        printf(_("It is important that you NOT FORGET this password.\n"));
         fflush(stdout);
 
         pw_size = 1024;
         pw_str = malloc(pw_size);
         if (pw_str == NULL) {
-            com_err(progname, ENOMEM, "while creating new master key");
+            com_err(progname, ENOMEM, _("while creating new master key"));
             exit_status++; return;
         }
 
         retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2,
                                     pw_str, &pw_size);
         if (retval) {
-            com_err(progname, retval, "while reading master key from keyboard");
+            com_err(progname, retval,
+                    _("while reading master key from keyboard"));
             exit_status++; return;
         }
         mkey_password = pw_str;
@@ -248,14 +250,15 @@ master key name '%s'\n",
     pwd.length = strlen(mkey_password);
     retval = krb5_principal2salt(util_context, master_princ, &master_salt);
     if (retval) {
-        com_err(progname, retval, "while calculating master key salt");
+        com_err(progname, retval, _("while calculating master key salt"));
         exit_status++; return;
     }
 
     retval = krb5_c_string_to_key(util_context, master_keyblock.enctype,
                                   &pwd, &master_salt, &master_keyblock);
     if (retval) {
-        com_err(progname, retval, "while transforming master key from password");
+        com_err(progname, retval,
+                _("while transforming master key from password"));
         exit_status++; return;
     }
 
@@ -265,12 +268,13 @@ master key name '%s'\n",
     seed.data = master_keyblock.contents;
 
     if ((retval = krb5_c_random_seed(util_context, &seed))) {
-        com_err(progname, retval, "while initializing random key generator");
+        com_err(progname, retval,
+                _("while initializing random key generator"));
         exit_status++; return;
     }
     if ((retval = krb5_db_create(util_context,
                                  db5util_db_args))) {
-        com_err(progname, retval, "while creating database '%s'",
+        com_err(progname, retval, _("while creating database '%s'"),
                 global_params.dbname);
         exit_status++; return;
     }
@@ -288,8 +292,7 @@ master key name '%s'\n",
         if ((retval = ulog_map(util_context, global_params.iprop_logfile,
                                global_params.iprop_ulogsize, FKCOMMAND,
                                db5util_db_args))) {
-            com_err(argv[0], retval,
-                    _("while creating update log"));
+            com_err(argv[0], retval, _("while creating update log"));
             exit_status++;
             return;
         }
@@ -316,7 +319,7 @@ master key name '%s'\n",
     if ((retval = add_principal(util_context, master_princ, MASTER_KEY, &rblock)) ||
         (retval = add_principal(util_context, &tgt_princ, TGT_KEY, &rblock))) {
         (void) krb5_db_fini(util_context);
-        com_err(progname, retval, "while adding entries to the database");
+        com_err(progname, retval, _("while adding entries to the database"));
         exit_status++; return;
     }
 
@@ -344,8 +347,8 @@ master key name '%s'\n",
                                       &master_keyblock,
                                       mkey_password);
     if (retval) {
-        com_err(progname, errno, "while storing key");
-        printf("Warning: couldn't stash master key.\n");
+        com_err(progname, errno, _("while storing key"));
+        printf(_("Warning: couldn't stash master key.\n"));
     }
     /* clean up */
     (void) krb5_db_fini(util_context);
diff --git a/src/kadmin/dbutil/kdb5_destroy.c b/src/kadmin/dbutil/kdb5_destroy.c
index 04cd340f7d..f32988a6de 100644
--- a/src/kadmin/dbutil/kdb5_destroy.c
+++ b/src/kadmin/dbutil/kdb5_destroy.c
@@ -55,13 +55,13 @@ kdb5_destroy(argc, argv)
     retval1 = kadm5_init_krb5_context(&context);
     if( retval1 )
     {
-        com_err(progname, retval1, "while initializing krb5_context");
+        com_err(progname, retval1, _("while initializing krb5_context"));
         exit(1);
     }
 
     if ((retval1 = krb5_set_default_realm(context,
                                           util_context->default_realm))) {
-        com_err(progname, retval1, "while setting default realm name");
+        com_err(progname, retval1, _("while setting default realm name"));
         exit(1);
     }
 
@@ -81,20 +81,21 @@ kdb5_destroy(argc, argv)
         }
     }
     if (!force) {
-        printf("Deleting KDC database stored in '%s', are you sure?\n", dbname);
-        printf("(type 'yes' to confirm)? ");
+        printf(_("Deleting KDC database stored in '%s', are you sure?\n"),
+               dbname);
+        printf(_("(type 'yes' to confirm)? "));
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
             exit_status++; return;
         }
         if (strcmp(buf, yes)) {
             exit_status++; return;
         }
-        printf("OK, deleting database '%s'...\n", dbname);
+        printf(_("OK, deleting database '%s'...\n"), dbname);
     }
 
     retval1 = krb5_db_destroy(context, db5util_db_args);
     if (retval1) {
-        com_err(progname, retval1, "deleting database '%s'",dbname);
+        com_err(progname, retval1, _("deleting database '%s'"), dbname);
         exit_status++; return;
     }
 
@@ -103,6 +104,6 @@ kdb5_destroy(argc, argv)
     }
 
     dbactive = FALSE;
-    printf("** Database '%s' destroyed.\n", dbname);
+    printf(_("** Database '%s' destroyed.\n"), dbname);
     return;
 }
diff --git a/src/kadmin/dbutil/kdb5_mkey.c b/src/kadmin/dbutil/kdb5_mkey.c
index 4bd72e50ef..e5da1927ec 100644
--- a/src/kadmin/dbutil/kdb5_mkey.c
+++ b/src/kadmin/dbutil/kdb5_mkey.c
@@ -218,7 +218,8 @@ kdb5_add_mkey(int argc, char *argv[])
         switch(optchar) {
         case 'e':
             if (krb5_string_to_enctype(optarg, &new_master_enctype)) {
-                com_err(progname, EINVAL, "%s is an invalid enctype", optarg);
+                com_err(progname, EINVAL, _("%s is an invalid enctype"),
+                        optarg);
                 exit_status++;
                 return;
             }
@@ -241,7 +242,7 @@ kdb5_add_mkey(int argc, char *argv[])
                                           global_params.mkey_name,
                                           global_params.realm,
                                           &mkey_fullname, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++;
         return;
     }
@@ -249,24 +250,23 @@ kdb5_add_mkey(int argc, char *argv[])
     retval = krb5_db_get_principal(util_context, master_princ, 0,
                                    &master_entry);
     if (retval != 0) {
-        com_err(progname, retval,
-                "while getting master key principal %s",
+        com_err(progname, retval, _("while getting master key principal %s"),
                 mkey_fullname);
         exit_status++;
         goto cleanup_return;
     }
 
-    printf("Creating new master key for master key principal '%s'\n",
+    printf(_("Creating new master key for master key principal '%s'\n"),
            mkey_fullname);
 
-    printf("You will be prompted for a new database Master Password.\n");
-    printf("It is important that you NOT FORGET this password.\n");
+    printf(_("You will be prompted for a new database Master Password.\n"));
+    printf(_("It is important that you NOT FORGET this password.\n"));
     fflush(stdout);
 
     pw_size = 1024;
     pw_str = malloc(pw_size);
     if (pw_str == NULL) {
-        com_err(progname, ENOMEM, "while creating new master key");
+        com_err(progname, ENOMEM, _("while creating new master key"));
         exit_status++;
         goto cleanup_return;
     }
@@ -274,7 +274,8 @@ kdb5_add_mkey(int argc, char *argv[])
     retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2,
                                 pw_str, &pw_size);
     if (retval) {
-        com_err(progname, retval, "while reading new master key from keyboard");
+        com_err(progname, retval,
+                _("while reading new master key from keyboard"));
         exit_status++;
         goto cleanup_return;
     }
@@ -284,7 +285,7 @@ kdb5_add_mkey(int argc, char *argv[])
     pwd.length = strlen(new_mkey_password);
     retval = krb5_principal2salt(util_context, master_princ, &master_salt);
     if (retval) {
-        com_err(progname, retval, "while calculating master key salt");
+        com_err(progname, retval, _("while calculating master key salt"));
         exit_status++;
         goto cleanup_return;
     }
@@ -292,34 +293,38 @@ kdb5_add_mkey(int argc, char *argv[])
     retval = krb5_c_string_to_key(util_context, new_master_enctype,
                                   &pwd, &master_salt, &new_mkeyblock);
     if (retval) {
-        com_err(progname, retval, "while transforming master key from password");
+        com_err(progname, retval,
+                _("while transforming master key from password"));
         exit_status++;
         goto cleanup_return;
     }
 
     retval = add_new_mkey(util_context, master_entry, &new_mkeyblock, 0);
     if (retval) {
-        com_err(progname, retval, "adding new master key to master principal");
+        com_err(progname, retval,
+                _("adding new master key to master principal"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_timeofday(util_context, &now))) {
-        com_err(progname, retval, "while getting current time");
+        com_err(progname, retval, _("while getting current time"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_dbe_update_mod_princ_data(util_context, master_entry,
                                                  now, master_princ))) {
-        com_err(progname, retval, "while updating the master key principal modification time");
+        com_err(progname, retval, _("while updating the master key principal "
+                                    "modification time"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_db_put_principal(util_context, master_entry))) {
         (void) krb5_db_fini(util_context);
-        com_err(progname, retval, "while adding master key entry to the database");
+        com_err(progname, retval, _("while adding master key entry to the "
+                                    "database"));
         exit_status++;
         goto cleanup_return;
     }
@@ -332,8 +337,8 @@ kdb5_add_mkey(int argc, char *argv[])
                                           &new_mkeyblock,
                                           mkey_password);
         if (retval) {
-            com_err(progname, errno, "while storing key");
-            printf("Warning: couldn't stash master key.\n");
+            com_err(progname, errno, _("while storing key"));
+            printf(_("Warning: couldn't stash master key.\n"));
         }
     }
 
@@ -375,7 +380,7 @@ kdb5_use_mkey(int argc, char *argv[])
 
     use_kvno = atoi(argv[1]);
     if (use_kvno == 0) {
-        com_err(progname, EINVAL, "0 is an invalid KVNO value");
+        com_err(progname, EINVAL, _("0 is an invalid KVNO value"));
         exit_status++;
         return;
     } else {
@@ -386,14 +391,15 @@ kdb5_use_mkey(int argc, char *argv[])
                 break;
         }
         if (!keylist_node) {
-            com_err(progname, EINVAL, "%d is an invalid KVNO value", use_kvno);
+            com_err(progname, EINVAL, _("%d is an invalid KVNO value"),
+                    use_kvno);
             exit_status++;
             return;
         }
     }
 
     if ((retval = krb5_timeofday(util_context, &now))) {
-        com_err(progname, retval, "while getting current time");
+        com_err(progname, retval, _("while getting current time"));
         exit_status++;
         return;
     }
@@ -401,7 +407,7 @@ kdb5_use_mkey(int argc, char *argv[])
     if (argc == 3) {
         time_t t = get_date(argv[2]);
         if (t == -1) {
-            com_err(progname, 0, "could not parse date-time string '%s'",
+            com_err(progname, 0, _("could not parse date-time string '%s'"),
                     argv[2]);
             exit_status++;
             return;
@@ -426,7 +432,7 @@ kdb5_use_mkey(int argc, char *argv[])
                                           global_params.mkey_name,
                                           global_params.realm,
                                           &mkey_fullname, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++;
         goto cleanup_return;
     }
@@ -434,8 +440,7 @@ kdb5_use_mkey(int argc, char *argv[])
     retval = krb5_db_get_principal(util_context, master_princ, 0,
                                    &master_entry);
     if (retval != 0) {
-        com_err(progname, retval,
-                "while getting master key principal %s",
+        com_err(progname, retval, _("while getting master key principal %s"),
                 mkey_fullname);
         exit_status++;
         goto cleanup_return;
@@ -444,7 +449,7 @@ kdb5_use_mkey(int argc, char *argv[])
     retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list);
     if (retval != 0) {
         com_err(progname, retval,
-                "while looking up active version of master key");
+                _("while looking up active version of master key"));
         exit_status++;
         goto cleanup_return;
     }
@@ -483,7 +488,7 @@ kdb5_use_mkey(int argc, char *argv[])
         /* alloc enough space to hold new and existing key_data */
         new_actkvno = (krb5_actkvno_node *) malloc(sizeof(krb5_actkvno_node));
         if (new_actkvno == NULL) {
-            com_err(progname, ENOMEM, "while adding new master key");
+            com_err(progname, ENOMEM, _("while adding new master key"));
             exit_status++;
             goto cleanup_return;
         }
@@ -520,28 +525,32 @@ kdb5_use_mkey(int argc, char *argv[])
     }
 
     if (actkvno_list->act_time > now) {
-        com_err(progname, EINVAL, "there must be one master key currently active");
+        com_err(progname, EINVAL,
+                _("there must be one master key currently active"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_dbe_update_actkvno(util_context, master_entry,
                                           actkvno_list))) {
-        com_err(progname, retval, "while updating actkvno data for master principal entry");
+        com_err(progname, retval,
+                _("while updating actkvno data for master principal entry"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_dbe_update_mod_princ_data(util_context, master_entry,
                                                  now, master_princ))) {
-        com_err(progname, retval, "while updating the master key principal modification time");
+        com_err(progname, retval, _("while updating the master key principal "
+                                    "modification time"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_db_put_principal(util_context, master_entry))) {
         (void) krb5_db_fini(util_context);
-        com_err(progname, retval, "while adding master key entry to the database");
+        com_err(progname, retval,
+                _("while adding master key entry to the database"));
         exit_status++;
         goto cleanup_return;
     }
@@ -568,7 +577,7 @@ kdb5_list_mkeys(int argc, char *argv[])
     krb5_keyblock *act_mkey;
 
     if (master_keylist == NULL) {
-        com_err(progname, 0, "master keylist not initialized");
+        com_err(progname, 0, _("master keylist not initialized"));
         exit_status++;
         return;
     }
@@ -578,7 +587,7 @@ kdb5_list_mkeys(int argc, char *argv[])
                                           global_params.mkey_name,
                                           global_params.realm,
                                           &mkey_fullname, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++;
         return;
     }
@@ -586,8 +595,7 @@ kdb5_list_mkeys(int argc, char *argv[])
     retval = krb5_db_get_principal(util_context, master_princ, 0,
                                    &master_entry);
     if (retval != 0) {
-        com_err(progname, retval,
-                "while getting master key principal %s",
+        com_err(progname, retval, _("while getting master key principal %s"),
                 mkey_fullname);
         exit_status++;
         goto cleanup_return;
@@ -595,7 +603,7 @@ kdb5_list_mkeys(int argc, char *argv[])
 
     retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list);
     if (retval != 0) {
-        com_err(progname, retval, "while looking up active kvno list");
+        com_err(progname, retval, _("while looking up active kvno list"));
         exit_status++;
         goto cleanup_return;
     }
@@ -612,7 +620,7 @@ kdb5_list_mkeys(int argc, char *argv[])
             /* Keep going.  */
             act_kvno = -1;
         } else if (retval != 0) {
-            com_err(progname, retval, "while looking up active master key");
+            com_err(progname, retval, _("while looking up active master key"));
             exit_status++;
             goto cleanup_return;
         }
@@ -625,7 +633,7 @@ kdb5_list_mkeys(int argc, char *argv[])
 
         if ((retval = krb5_enctype_to_name(cur_kb_node->keyblock.enctype,
                                            FALSE, enctype, sizeof(enctype)))) {
-            com_err(progname, retval, "while getting enctype description");
+            com_err(progname, retval, _("while getting enctype description"));
             exit_status++;
             goto cleanup_return;
         }
@@ -645,7 +653,7 @@ kdb5_list_mkeys(int argc, char *argv[])
              * key is active now
              */
             if ((retval = krb5_timeofday(util_context, &act_time))) {
-                com_err(progname, retval, "while getting current time");
+                com_err(progname, retval, _("while getting current time"));
                 exit_status++;
                 goto cleanup_return;
             }
@@ -653,19 +661,23 @@ kdb5_list_mkeys(int argc, char *argv[])
 
         if (cur_kb_node->kvno == act_kvno) {
             /* * indicates kvno is currently active */
-            retval = asprintf(&output_str, "KNVO: %d, Enctype: %s, Active on: %s *\n",
+            retval = asprintf(&output_str,
+                              _("KNVO: %d, Enctype: %s, Active on: %s *\n"),
                               cur_kb_node->kvno, enctype, strdate(act_time));
         } else {
             if (act_time != -1) {
-                retval = asprintf(&output_str, "KNVO: %d, Enctype: %s, Active on: %s\n",
+                retval = asprintf(&output_str,
+                                  _("KNVO: %d, Enctype: %s, Active on: %s\n"),
                                   cur_kb_node->kvno, enctype, strdate(act_time));
             } else {
-                retval = asprintf(&output_str, "KNVO: %d, Enctype: %s, No activate time set\n",
-                                  cur_kb_node->kvno, enctype);
+                retval = asprintf(&output_str,
+                                  _("KNVO: %d, Enctype: %s, No activate time "
+                                    "set\n"), cur_kb_node->kvno, enctype);
             }
         }
         if (retval == -1) {
-            com_err(progname, ENOMEM, "asprintf could not allocate enough memory to hold output");
+            com_err(progname, ENOMEM, _("asprintf could not allocate enough "
+                                        "memory to hold output"));
             exit_status++;
             goto cleanup_return;
         }
@@ -799,7 +811,7 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent)
     retval = krb5_unparse_name(util_context, ent->princ, &pname);
     if (retval) {
         com_err(progname, retval,
-                "getting string representation of principal name");
+                _("getting string representation of principal name"));
         goto fail;
     }
 
@@ -823,50 +835,48 @@ update_princ_encryption_1(void *cb, krb5_db_entry *ent)
     retval = krb5_dbe_get_mkvno(util_context, ent, master_keylist, &old_mkvno);
     if (retval) {
         com_err(progname, retval,
-                "determining master key used for principal '%s'",
-                pname);
+                _("determining master key used for principal '%s'"), pname);
         goto fail;
     }
     /* Line up "skip" and "update" messages for viewing.  */
     if (old_mkvno == new_mkvno) {
         if (p->dry_run && p->verbose)
-            printf("would skip:   %s\n", pname);
+            printf(_("would skip:   %s\n"), pname);
         else if (p->verbose)
-            printf("skipping: %s\n", pname);
+            printf(_("skipping: %s\n"), pname);
         p->already_current++;
         goto skip;
     }
     if (p->dry_run) {
         if (p->verbose)
-            printf("would update: %s\n", pname);
+            printf(_("would update: %s\n"), pname);
         p->updated++;
         goto skip;
     } else if (p->verbose)
-        printf("updating: %s\n", pname);
+        printf(_("updating: %s\n"), pname);
     retval = master_key_convert (util_context, ent);
     if (retval) {
         com_err(progname, retval,
-                "error re-encrypting key for principal '%s'", pname);
+                _("error re-encrypting key for principal '%s'"), pname);
         goto fail;
     }
     if ((retval = krb5_timeofday(util_context, &now))) {
-        com_err(progname, retval, "while getting current time");
+        com_err(progname, retval, _("while getting current time"));
         goto fail;
     }
 
     if ((retval = krb5_dbe_update_mod_princ_data(util_context, ent,
                                                  now, master_princ))) {
         com_err(progname, retval,
-                "while updating principal '%s' modification time", pname);
+                _("while updating principal '%s' modification time"), pname);
         goto fail;
     }
 
     ent->mask |= KADM5_KEY_DATA;
 
     if ((retval = krb5_db_put_principal(util_context, ent))) {
-        com_err(progname, retval,
-                "while updating principal '%s' key data in the database",
-                pname);
+        com_err(progname, retval, _("while updating principal '%s' key data "
+                                    "in the database"), pname);
         goto fail;
     }
     p->updated++;
@@ -897,7 +907,7 @@ are_you_sure (const char *format, ...)
     va_start(va, format);
     vprintf(format, va);
     va_end(va);
-    printf("\n(type 'yes' to confirm)? ");
+    printf(_("\n(type 'yes' to confirm)? "));
     fflush(stdout);
     if (fgets(ansbuf, sizeof(ansbuf), stdin) == NULL)
         return 0;
@@ -948,13 +958,13 @@ kdb5_update_princ_encryption(int argc, char *argv[])
 
     retval = krb5_unparse_name(util_context, master_princ, &mkey_fullname);
     if (retval) {
-        com_err(progname, retval, "while formatting master principal name");
+        com_err(progname, retval, _("while formatting master principal name"));
         exit_status++;
         goto cleanup;
     }
 
     if (master_keylist == NULL) {
-        com_err(progname, retval, "master keylist not initialized");
+        com_err(progname, retval, _("master keylist not initialized"));
         exit_status++;
         goto cleanup;
     }
@@ -965,7 +975,7 @@ kdb5_update_princ_encryption(int argc, char *argv[])
         name_pattern = "*";
     if (glob_to_regexp(name_pattern, "hi", &regexp) != 0) {
         com_err(progname, ENOMEM,
-                "converting glob pattern '%s' to regular expression",
+                _("converting glob pattern '%s' to regular expression"),
                 name_pattern);
         exit_status++;
         goto cleanup;
@@ -983,7 +993,8 @@ kdb5_update_princ_encryption(int argc, char *argv[])
 #endif
     ) {
         /* XXX syslog msg or regerr(regerrno) */
-        com_err(progname, 0, "error compiling converted regexp '%s'", regexp);
+        com_err(progname, 0, _("error compiling converted regexp '%s'"),
+                regexp);
         exit_status++;
         goto cleanup;
     }
@@ -991,7 +1002,7 @@ kdb5_update_princ_encryption(int argc, char *argv[])
     retval = krb5_db_get_principal(util_context, master_princ, 0,
                                    &master_entry);
     if (retval != 0) {
-        com_err(progname, retval, "while getting master key principal %s",
+        com_err(progname, retval, _("while getting master key principal %s"),
                 mkey_fullname);
         exit_status++;
         goto cleanup;
@@ -999,7 +1010,7 @@ kdb5_update_princ_encryption(int argc, char *argv[])
 
     retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list);
     if (retval != 0) {
-        com_err(progname, retval, "while looking up active kvno list");
+        com_err(progname, retval, _("while looking up active kvno list"));
         exit_status++;
         goto cleanup;
     }
@@ -1013,7 +1024,7 @@ kdb5_update_princ_encryption(int argc, char *argv[])
     retval = krb5_dbe_find_mkey(util_context, master_keylist,
                                 master_entry, &tmp_keyblock);
     if (retval) {
-        com_err(progname, retval, "retrieving the most recent master key");
+        com_err(progname, retval, _("retrieving the most recent master key"));
         exit_status++;
         goto cleanup;
     }
@@ -1021,19 +1032,20 @@ kdb5_update_princ_encryption(int argc, char *argv[])
 
     if (!force &&
         !data.dry_run &&
-        !are_you_sure("Re-encrypt all keys not using master key vno %u?",
+        !are_you_sure(_("Re-encrypt all keys not using master key vno %u?"),
                       new_mkvno)) {
-        printf("OK, doing nothing.\n");
+        printf(_("OK, doing nothing.\n"));
         exit_status++;
         goto cleanup;
     }
     if (data.verbose) {
-        if (data.dry_run)
-            printf("Principals whose keys WOULD BE re-encrypted to master key vno %u:\n",
-                   new_mkvno);
-        else
-            printf("Principals whose keys are being re-encrypted to master key vno %u if necessary:\n",
-                   new_mkvno);
+        if (data.dry_run) {
+            printf(_("Principals whose keys WOULD BE re-encrypted to master "
+                     "key vno %u:\n"), new_mkvno);
+        } else {
+            printf(_("Principals whose keys are being re-encrypted to master "
+                     "key vno %u if necessary:\n"), new_mkvno);
+        }
     }
 
     retval = krb5_db_iterate(util_context, name_pattern,
@@ -1041,16 +1053,18 @@ kdb5_update_princ_encryption(int argc, char *argv[])
     /* If exit_status is set, then update_princ_encryption_1 already
        printed a message.  */
     if (retval != 0 && exit_status == 0) {
-        com_err(progname, retval, "trying to process principal database");
+        com_err(progname, retval, _("trying to process principal database"));
         exit_status++;
     }
     (void) krb5_db_fini(util_context);
-    if (data.dry_run)
-        printf("%u principals processed: %u would be updated, %u already current\n",
+    if (data.dry_run) {
+        printf(_("%u principals processed: %u would be updated, %u already "
+                 "current\n"),
                data.re_match_count, data.updated, data.already_current);
-    else
-        printf("%u principals processed: %u updated, %u already current\n",
+    } else {
+        printf(_("%u principals processed: %u updated, %u already current\n"),
                data.re_match_count, data.updated, data.already_current);
+    }
 
 cleanup:
     free(regexp);
@@ -1137,7 +1151,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
     }
 
     if (master_keylist == NULL) {
-        com_err(progname, 0, "master keylist not initialized");
+        com_err(progname, 0, _("master keylist not initialized"));
         exit_status++;
         return;
     }
@@ -1147,7 +1161,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
                                           global_params.mkey_name,
                                           global_params.realm,
                                           &mkey_fullname, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++;
         return;
     }
@@ -1155,17 +1169,16 @@ kdb5_purge_mkeys(int argc, char *argv[])
     retval = krb5_db_get_principal(util_context, master_princ, 0,
                                    &master_entry);
     if (retval != 0) {
-        com_err(progname, retval,
-                "while getting master key principal %s",
+        com_err(progname, retval, _("while getting master key principal %s"),
                 mkey_fullname);
         exit_status++;
         goto cleanup_return;
     }
 
     if (!force) {
-        printf("Will purge all unused master keys stored in the '%s' principal, are you sure?\n",
-               mkey_fullname);
-        printf("(type 'yes' to confirm)? ");
+        printf(_("Will purge all unused master keys stored in the '%s' "
+                 "principal, are you sure?\n"), mkey_fullname);
+        printf(_("(type 'yes' to confirm)? "));
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
             exit_status++;
             goto cleanup_return;
@@ -1174,14 +1187,16 @@ kdb5_purge_mkeys(int argc, char *argv[])
             exit_status++;
             goto cleanup_return;
         }
-        printf("OK, purging unused master keys from '%s'...\n", mkey_fullname);
+        printf(_("OK, purging unused master keys from '%s'...\n"),
+               mkey_fullname);
     }
 
     /* save the old keydata */
     old_key_data_count = master_entry->n_key_data;
     if (old_key_data_count == 1) {
         if (verbose)
-            printf("There is only one master key which can not be purged.\n");
+            printf(_("There is only one master key which can not be "
+                     "purged.\n"));
         goto cleanup_return;
     }
     old_key_data = master_entry->key_data;
@@ -1189,7 +1204,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
     args.kvnos = (struct kvnos_in_use *) malloc(sizeof(struct kvnos_in_use) * old_key_data_count);
     if (args.kvnos == NULL) {
         retval = ENOMEM;
-        com_err(progname, ENOMEM, "while allocating args.kvnos");
+        com_err(progname, ENOMEM, _("while allocating args.kvnos"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1205,7 +1220,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
                                   NULL,
                                   find_mkvnos_in_use,
                                   (krb5_pointer) &args))) {
-        com_err(progname, retval, "while finding master keys in use");
+        com_err(progname, retval, _("while finding master keys in use"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1213,10 +1228,13 @@ kdb5_purge_mkeys(int argc, char *argv[])
      * args.kvnos has been marked with the mkvno's that are currently protecting
      * princ entries
      */
-    if (dry_run)
-        printf("Would purge the follwing master key(s) from %s:\n", mkey_fullname);
-    else
-        printf("Purging the follwing master key(s) from %s:\n", mkey_fullname);
+    if (dry_run) {
+        printf(_("Would purge the follwing master key(s) from %s:\n"),
+               mkey_fullname);
+    } else {
+        printf(_("Purging the follwing master key(s) from %s:\n"),
+               mkey_fullname);
+    }
 
     /* find # of keys still in use or print out verbose info */
     for (i = num_kvnos_inuse = num_kvnos_purged = 0; i < args.num_kvnos; i++) {
@@ -1226,35 +1244,36 @@ kdb5_purge_mkeys(int argc, char *argv[])
             /* this key would be deleted */
             if (args.kvnos[i].kvno == master_kvno) {
                 com_err(progname, KRB5_KDB_STORED_MKEY_NOTCURRENT,
-                        "master key stash file needs updating, command aborting");
+                        _("master key stash file needs updating, command "
+                          "aborting"));
                 exit_status++;
                 goto cleanup_return;
             }
             num_kvnos_purged++;
-            printf("KNVO: %d\n", args.kvnos[i].kvno);
+            printf(_("KVNO: %d\n"), args.kvnos[i].kvno);
         }
     }
     /* didn't find any keys to purge */
     if (num_kvnos_inuse == args.num_kvnos) {
-        printf("All keys in use, nothing purged.\n");
+        printf(_("All keys in use, nothing purged.\n"));
         goto cleanup_return;
     }
     if (dry_run) {
         /* bail before doing anything else */
-        printf("%d key(s) would be purged.\n", num_kvnos_purged);
+        printf(_("%d key(s) would be purged.\n"), num_kvnos_purged);
         goto cleanup_return;
     }
 
     retval = krb5_dbe_lookup_actkvno(util_context, master_entry, &actkvno_list);
     if (retval != 0) {
-        com_err(progname, retval, "while looking up active kvno list");
+        com_err(progname, retval, _("while looking up active kvno list"));
         exit_status++;
         goto cleanup_return;
     }
 
     retval = krb5_dbe_lookup_mkey_aux(util_context, master_entry, &mkey_aux_list);
     if (retval != 0) {
-        com_err(progname, retval, "while looking up mkey aux data list");
+        com_err(progname, retval, _("while looking up mkey aux data list"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1262,7 +1281,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
     master_entry->key_data = (krb5_key_data *) malloc(sizeof(krb5_key_data) * num_kvnos_inuse);
     if (master_entry->key_data == NULL) {
         retval = ENOMEM;
-        com_err(progname, ENOMEM, "while allocating key_data");
+        com_err(progname, ENOMEM, _("while allocating key_data"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1335,7 +1354,7 @@ kdb5_purge_mkeys(int argc, char *argv[])
     if ((retval = krb5_dbe_update_actkvno(util_context, master_entry,
                                           actkvno_list))) {
         com_err(progname, retval,
-                "while updating actkvno data for master principal entry");
+                _("while updating actkvno data for master principal entry"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1343,21 +1362,21 @@ kdb5_purge_mkeys(int argc, char *argv[])
     if ((retval = krb5_dbe_update_mkey_aux(util_context, master_entry,
                                            mkey_aux_list))) {
         com_err(progname, retval,
-                "while updating mkey_aux data for master principal entry");
+                _("while updating mkey_aux data for master principal entry"));
         exit_status++;
         return;
     }
 
     if ((retval = krb5_timeofday(util_context, &now))) {
-        com_err(progname, retval, "while getting current time");
+        com_err(progname, retval, _("while getting current time"));
         exit_status++;
         goto cleanup_return;
     }
 
     if ((retval = krb5_dbe_update_mod_princ_data(util_context, master_entry,
                                                  now, master_princ))) {
-        com_err(progname, retval,
-                "while updating the master key principal modification time");
+        com_err(progname, retval, _("while updating the master key principal "
+                                    "modification time"));
         exit_status++;
         goto cleanup_return;
     }
@@ -1366,11 +1385,12 @@ kdb5_purge_mkeys(int argc, char *argv[])
 
     if ((retval = krb5_db_put_principal(util_context, master_entry))) {
         (void) krb5_db_fini(util_context);
-        com_err(progname, retval, "while adding master key entry to the database");
+        com_err(progname, retval,
+                _("while adding master key entry to the database"));
         exit_status++;
         goto cleanup_return;
     }
-    printf("%d key(s) purged.\n", num_kvnos_purged);
+    printf(_("%d key(s) purged.\n"), num_kvnos_purged);
 
 cleanup_return:
     /* clean up */
diff --git a/src/kadmin/dbutil/kdb5_stash.c b/src/kadmin/dbutil/kdb5_stash.c
index 23b54f895c..35592b8082 100644
--- a/src/kadmin/dbutil/kdb5_stash.c
+++ b/src/kadmin/dbutil/kdb5_stash.c
@@ -95,7 +95,7 @@ kdb5_stash(argc, argv)
         if (krb5_enctype_to_name(master_keyblock.enctype, FALSE,
                                  tmp, sizeof(tmp)))
             com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP,
-                    "while setting up enctype %d", master_keyblock.enctype);
+                    _("while setting up enctype %d"), master_keyblock.enctype);
         else
             com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP, "%s", tmp);
         exit_status++; return;
@@ -114,7 +114,7 @@ kdb5_stash(argc, argv)
                                     &mkey_kvno,
                                     NULL, &master_keyblock);
         if (retval) {
-            com_err(progname, retval, "while reading master key");
+            com_err(progname, retval, _("while reading master key"));
             exit_status++; return;
         }
 
@@ -122,17 +122,17 @@ kdb5_stash(argc, argv)
                                          &master_keyblock, mkey_kvno,
                                          &master_keylist);
         if (retval) {
-            com_err(progname, retval, "while getting master key list");
+            com_err(progname, retval, _("while getting master key list"));
             exit_status++; return;
         }
     } else {
-        printf("Using existing stashed keys to update stash file.\n");
+        printf(_("Using existing stashed keys to update stash file.\n"));
     }
 
     retval = krb5_db_store_master_key_list(util_context, keyfile, master_princ,
                                            master_keylist, NULL);
     if (retval) {
-        com_err(progname, errno, "while storing key");
+        com_err(progname, errno, _("while storing key"));
         exit_status++; return;
     }
 
diff --git a/src/kadmin/dbutil/kdb5_util.c b/src/kadmin/dbutil/kdb5_util.c
index e7a555fafb..7f5d6746b4 100644
--- a/src/kadmin/dbutil/kdb5_util.c
+++ b/src/kadmin/dbutil/kdb5_util.c
@@ -76,27 +76,31 @@ kadm5_config_params global_params;
 
 void usage()
 {
-    fprintf(stderr, "Usage: "
-            "kdb5_util [-x db_args]* [-r realm] [-d dbname] [-k mkeytype] [-M mkeyname]\n"
-            "\t        [-kv mkeyVNO] [-sf stashfilename] [-m] cmd [cmd_options]\n"
-            "\tcreate  [-s]\n"
-            "\tdestroy [-f]\n"
-            "\tstash   [-f keyfile]\n"
-            "\tdump    [-old|-ov|-b6|-b7|-r13] [-verbose]\n"
-            "\t        [-mkey_convert] [-new_mkey_file mkey_file]\n"
-            "\t        [-rev] [-recurse] [filename [princs...]]\n"
-            "\tload    [-old|-ov|-b6|-b7|-r13] [-verbose] [-update] filename\n"
-            "\tark     [-e etype_list] principal\n"
-            "\tadd_mkey [-e etype] [-s]\n"
-            "\tuse_mkey kvno [time]\n"
-            "\tlist_mkeys\n"
-    );
+    fprintf(stderr,
+            _("Usage: kdb5_util [-x db_args]* [-r realm] [-d dbname] "
+              "[-k mkeytype] [-M mkeyname]\n"
+              "\t        [-kv mkeyVNO] [-sf stashfilename] [-m] cmd "
+              "[cmd_options]\n"
+              "\tcreate  [-s]\n"
+              "\tdestroy [-f]\n"
+              "\tstash   [-f keyfile]\n"
+              "\tdump    [-old|-ov|-b6|-b7|-r13] [-verbose]\n"
+              "\t        [-mkey_convert] [-new_mkey_file mkey_file]\n"
+              "\t        [-rev] [-recurse] [filename [princs...]]\n"
+              "\tload    [-old|-ov|-b6|-b7|-r13] [-verbose] [-update] "
+              "filename\n"
+              "\tark     [-e etype_list] principal\n"
+              "\tadd_mkey [-e etype] [-s]\n"
+              "\tuse_mkey kvno [time]\n"
+              "\tlist_mkeys\n"));
     /* avoid a string length compiler warning */
     fprintf(stderr,
-            "\tupdate_princ_encryption [-f] [-n] [-v] [princ-pattern]\n"
-            "\tpurge_mkeys [-f] [-n] [-v]\n"
-            "\nwhere,\n\t[-x db_args]* - any number of database specific arguments.\n"
-            "\t\t\tLook at each database documentation for supported arguments\n");
+            _("\tupdate_princ_encryption [-f] [-n] [-v] [princ-pattern]\n"
+              "\tpurge_mkeys [-f] [-n] [-v]\n"
+              "\nwhere,\n\t[-x db_args]* - any number of database specific "
+              "arguments.\n"
+              "\t\t\tLook at each database documentation for supported "
+              "arguments\n"));
     exit(1);
 }
 
@@ -204,13 +208,13 @@ int main(argc, argv)
 
     retval = kadm5_init_krb5_context(&util_context);
     if (retval) {
-        com_err (progname, retval, "while initializing Kerberos code");
+        com_err (progname, retval, _("while initializing Kerberos code"));
         exit(1);
     }
 
     cmd_argv = (char **) malloc(sizeof(char *)*argc);
     if (cmd_argv == NULL) {
-        com_err(progname, ENOMEM, "while creating sub-command arguments");
+        com_err(progname, ENOMEM, _("while creating sub-command arguments"));
         exit(1);
     }
     memset(cmd_argv, 0, sizeof(char *)*argc);
@@ -227,18 +231,21 @@ int main(argc, argv)
 
             if (asprintf(&db_name_tmp, "dbname=%s", global_params.dbname) < 0)
             {
-                com_err(progname, ENOMEM, "while parsing command arguments");
+                com_err(progname, ENOMEM,
+                        _("while parsing command arguments"));
                 exit(1);
             }
 
             if (!add_db_arg(db_name_tmp)) {
-                com_err(progname, ENOMEM, "while parsing command arguments\n");
+                com_err(progname, ENOMEM,
+                        _("while parsing command arguments\n"));
                 exit(1);
             }
 
         } else if (strcmp(*argv, "-x") == 0 && ARG_VAL) {
             if (!add_db_arg(koptarg)) {
-                com_err(progname, ENOMEM, "while parsing command arguments\n");
+                com_err(progname, ENOMEM,
+                        _("while parsing command arguments\n"));
                 exit(1);
             }
 
@@ -248,19 +255,22 @@ int main(argc, argv)
             /* not sure this is really necessary */
             if ((retval = krb5_set_default_realm(util_context,
                                                  global_params.realm))) {
-                com_err(progname, retval, "while setting default realm name");
+                com_err(progname, retval,
+                        _("while setting default realm name"));
                 exit(1);
             }
         } else if (strcmp(*argv, "-k") == 0 && ARG_VAL) {
             if (krb5_string_to_enctype(koptarg, &global_params.enctype)) {
-                com_err(progname, EINVAL, ": %s is an invalid enctype", koptarg);
+                com_err(progname, EINVAL, _(": %s is an invalid enctype"),
+                        koptarg);
                 exit(1);
             } else
                 global_params.mask |= KADM5_CONFIG_ENCTYPE;
         } else if (strcmp(*argv, "-kv") == 0 && ARG_VAL) {
             global_params.kvno = (krb5_kvno) atoi(koptarg);
             if (global_params.kvno == IGNORE_VNO) {
-                com_err(progname, EINVAL, ": %s is an invalid mkeyVNO", koptarg);
+                com_err(progname, EINVAL, _(": %s is an invalid mkeyVNO"),
+                        koptarg);
                 exit(1);
             } else
                 global_params.mask |= KADM5_CONFIG_KVNO;
@@ -294,7 +304,7 @@ int main(argc, argv)
         retval = krb5_get_default_realm(util_context, &temp);
         if( retval )
         {
-            com_err (progname, retval, "while getting default realm");
+            com_err(progname, retval, _("while getting default realm"));
             exit(1);
         }
         util_context->default_realm = temp;
@@ -303,7 +313,8 @@ int main(argc, argv)
     retval = kadm5_get_config_params(util_context, 1,
                                      &global_params, &global_params);
     if (retval) {
-        com_err(progname, retval, "while retreiving configuration parameters");
+        com_err(progname, retval,
+                _("while retreiving configuration parameters"));
         exit(1);
     }
 
@@ -354,14 +365,14 @@ void set_dbname(argc, argv)
     krb5_error_code retval;
 
     if (argc < 3) {
-        com_err(argv[0], 0, "Too few arguments");
-        com_err(progname, 0, "Usage: %s dbpathname realmname", argv[0]);
+        com_err(argv[0], 0, _("Too few arguments"));
+        com_err(progname, 0, _("Usage: %s dbpathname realmname"), argv[0]);
         exit_status++;
         return;
     }
     if (dbactive) {
         if ((retval = krb5_db_fini(util_context)) && retval!= KRB5_KDB_DBNOTINITED) {
-            com_err(progname, retval, "while closing previous database");
+            com_err(progname, retval, _("while closing previous database"));
             exit_status++;
             return;
         }
@@ -398,7 +409,7 @@ static int open_db_and_mkey()
 
     if ((retval = krb5_db_open(util_context, db5util_db_args,
                                KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_ADMIN))) {
-        com_err(progname, retval, "while initializing database");
+        com_err(progname, retval, _("while initializing database"));
         exit_status++;
         return(1);
     }
@@ -409,13 +420,13 @@ static int open_db_and_mkey()
                                           global_params.mkey_name,
                                           global_params.realm,
                                           0, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         exit_status++;
         return(1);
     }
     if ((retval = krb5_db_get_principal(util_context, master_princ, 0,
                                         &master_entry))) {
-        com_err(progname, retval, "while retrieving master entry");
+        com_err(progname, retval, _("while retrieving master entry"));
         exit_status++;
         (void) krb5_db_fini(util_context);
         return(1);
@@ -434,7 +445,7 @@ static int open_db_and_mkey()
         pwd.length = strlen(mkey_password);
         retval = krb5_principal2salt(util_context, master_princ, &scratch);
         if (retval) {
-            com_err(progname, retval, "while calculated master key salt");
+            com_err(progname, retval, _("while calculated master key salt"));
             exit_status++;
             return(1);
         }
@@ -451,7 +462,7 @@ static int open_db_and_mkey()
                                       &pwd, &scratch, &master_keyblock);
         if (retval) {
             com_err(progname, retval,
-                    "while transforming master key from password");
+                    _("while transforming master key from password"));
             exit_status++;
             return(1);
         }
@@ -465,8 +476,8 @@ static int open_db_and_mkey()
                                          global_params.stash_file,
                                          &master_kvno,
                                          0, &master_keyblock))) {
-            com_err(progname, retval, "while reading master key");
-            com_err(progname, 0, "Warning: proceeding without master key");
+            com_err(progname, retval, _("while reading master key"));
+            com_err(progname, 0, _("Warning: proceeding without master key"));
             exit_status++;
             return(0);
         }
@@ -485,7 +496,7 @@ static int open_db_and_mkey()
     seed.data = (char *) master_keyblock.contents;
 
     if ((retval = krb5_c_random_seed(util_context, &seed))) {
-        com_err(progname, retval, "while seeding random number generator");
+        com_err(progname, retval, _("while seeding random number generator"));
         exit_status++;
         memset(master_keyblock.contents, 0, master_keyblock.length);
         krb5_free_keyblock_contents(util_context, &master_keyblock);
@@ -497,8 +508,7 @@ static int open_db_and_mkey()
         if (ulog_map(util_context, global_params.iprop_logfile,
                      global_params.iprop_ulogsize, FKCOMMAND,
                      db5util_db_args)) {
-            fprintf(stderr, _("%s: Could not map log\n"),
-                    progname);
+            fprintf(stderr, _("%s: Could not map log\n"), progname);
             exit_status++;
             return(1);
         }
@@ -526,7 +536,7 @@ quit()
     memset(master_keyblock.contents, 0, master_keyblock.length);
     finished = TRUE;
     if (retval && retval != KRB5_KDB_DBNOTINITED) {
-        com_err(progname, retval, "while closing database");
+        com_err(progname, retval, _("while closing database"));
         exit_status++;
         return 1;
     }
@@ -567,13 +577,13 @@ add_random_key(argc, argv)
     pr_str = *argv;
     ret = krb5_parse_name(util_context, pr_str, &princ);
     if (ret) {
-        com_err(me, ret, "while parsing principal name %s", pr_str);
+        com_err(me, ret, _("while parsing principal name %s"), pr_str);
         exit_status++;
         return;
     }
     ret = krb5_db_get_principal(util_context, princ, 0, &dbent);
     if (ret) {
-        com_err(me, ret, "while fetching principal %s", pr_str);
+        com_err(me, ret, _("while fetching principal %s"), pr_str);
         exit_status++;
         return;
     }
@@ -582,7 +592,7 @@ add_random_key(argc, argv)
                                   &keysalts,
                                   &num_keysalts);
     if (ret) {
-        com_err(me, ret, "while parsing keysalts %s", ks_str);
+        com_err(me, ret, _("while parsing keysalts %s"), ks_str);
         exit_status++;
         return;
     }
@@ -596,7 +606,7 @@ add_random_key(argc, argv)
     /* Find the mkey used to protect the existing keys */
     ret = krb5_dbe_find_mkey(util_context, master_keylist, dbent, &tmp_mkey);
     if (ret) {
-        com_err(me, ret, "while finding mkey");
+        com_err(me, ret, _("while finding mkey"));
         krb5_db_free_principal(util_context, dbent);
         exit_status++;
         return;
@@ -614,14 +624,14 @@ add_random_key(argc, argv)
     dbent->attributes &= ~KRB5_KDB_REQUIRES_PWCHANGE;
     ret = krb5_timeofday(util_context, &now);
     if (ret) {
-        com_err(me, ret, "while getting time");
+        com_err(me, ret, _("while getting time"));
         krb5_db_free_principal(util_context, dbent);
         exit_status++;
         return;
     }
     ret = krb5_dbe_update_last_pwd_change(util_context, dbent, now);
     if (ret) {
-        com_err(me, ret, "while setting changetime");
+        com_err(me, ret, _("while setting changetime"));
         krb5_db_free_principal(util_context, dbent);
         exit_status++;
         return;
@@ -629,9 +639,9 @@ add_random_key(argc, argv)
     ret = krb5_db_put_principal(util_context, dbent);
     krb5_db_free_principal(util_context, dbent);
     if (ret) {
-        com_err(me, ret, "while saving principal %s", pr_str);
+        com_err(me, ret, _("while saving principal %s"), pr_str);
         exit_status++;
         return;
     }
-    printf("%s changed\n", pr_str);
+    printf(_("%s changed\n"), pr_str);
 }
diff --git a/src/kadmin/ktutil/ktutil.c b/src/kadmin/ktutil/ktutil.c
index 162ea42158..7fe15449e3 100644
--- a/src/kadmin/ktutil/ktutil.c
+++ b/src/kadmin/ktutil/ktutil.c
@@ -47,13 +47,13 @@ int main(argc, argv)
 
     retval = krb5_init_context(&kcontext);
     if (retval) {
-        com_err(argv[0], retval, "while initializing krb5");
+        com_err(argv[0], retval, _("while initializing krb5"));
         exit(1);
     }
     sci_idx = ss_create_invocation("ktutil", "5.0", (char *)NULL,
                                    &ktutil_cmds, &retval);
     if (retval) {
-        ss_perror(sci_idx, retval, "creating invocation");
+        ss_perror(sci_idx, retval, _("creating invocation"));
         exit(1);
     }
     retval = ss_listen(sci_idx);
@@ -68,12 +68,12 @@ void ktutil_clear_list(argc, argv)
     krb5_error_code retval;
 
     if (argc != 1) {
-        fprintf(stderr, "%s: invalid arguments\n", argv[0]);
+        fprintf(stderr, _("%s: invalid arguments\n"), argv[0]);
         return;
     }
     retval = ktutil_free_kt_list(kcontext, ktlist);
     if (retval)
-        com_err(argv[0], retval, "while freeing ktlist");
+        com_err(argv[0], retval, _("while freeing ktlist"));
     ktlist = NULL;
 }
 
@@ -84,12 +84,12 @@ void ktutil_read_v5(argc, argv)
     krb5_error_code retval;
 
     if (argc != 2) {
-        fprintf(stderr, "%s: must specify keytab to read\n", argv[0]);
+        fprintf(stderr, _("%s: must specify keytab to read\n"), argv[0]);
         return;
     }
     retval = ktutil_read_keytab(kcontext, argv[1], &ktlist);
     if (retval)
-        com_err(argv[0], retval, "while reading keytab \"%s\"", argv[1]);
+        com_err(argv[0], retval, _("while reading keytab \"%s\""), argv[1]);
 }
 
 void ktutil_read_v4(argc, argv)
@@ -99,12 +99,12 @@ void ktutil_read_v4(argc, argv)
     krb5_error_code retval;
 
     if (argc != 2) {
-        fprintf(stderr, "%s: must specify the srvtab to read\n", argv[0]);
+        fprintf(stderr, _("%s: must specify the srvtab to read\n"), argv[0]);
         return;
     }
     retval = ktutil_read_srvtab(kcontext, argv[1], &ktlist);
     if (retval)
-        com_err(argv[0], retval, "while reading srvtab \"%s\"", argv[1]);
+        com_err(argv[0], retval, _("while reading srvtab \"%s\""), argv[1]);
 }
 
 void ktutil_write_v5(argc, argv)
@@ -114,19 +114,20 @@ void ktutil_write_v5(argc, argv)
     krb5_error_code retval;
 
     if (argc != 2) {
-        fprintf(stderr, "%s: must specify keytab to write\n", argv[0]);
+        fprintf(stderr, _("%s: must specify keytab to write\n"), argv[0]);
         return;
     }
     retval = ktutil_write_keytab(kcontext, ktlist, argv[1]);
     if (retval)
-        com_err(argv[0], retval, "while writing keytab \"%s\"", argv[1]);
+        com_err(argv[0], retval, _("while writing keytab \"%s\""), argv[1]);
 }
 
 void ktutil_write_v4(argc, argv)
     int argc;
     char *argv[];
 {
-    fprintf(stderr, "%s: writing srvtabs is no longer supported\n", argv[0]);
+    fprintf(stderr, _("%s: writing srvtabs is no longer supported\n"),
+            argv[0]);
 }
 
 void ktutil_add_entry(argc, argv)
@@ -163,14 +164,14 @@ void ktutil_add_entry(argc, argv)
     }
 
     if (argc != 8 || !(princ && kvno && enctype) || (use_pass+use_key != 1)) {
-        fprintf(stderr, "usage: %s (-key | -password) -p principal "
-                "-k kvno -e enctype\n", argv[0]);
+        fprintf(stderr, _("usage: %s (-key | -password) -p principal "
+                          "-k kvno -e enctype\n"), argv[0]);
         return;
     }
 
     retval = ktutil_add(kcontext, &ktlist, princ, kvno, enctype, use_pass);
     if (retval)
-        com_err(argv[0], retval, "while adding new entry");
+        com_err(argv[0], retval, _("while adding new entry"));
 }
 
 void ktutil_delete_entry(argc, argv)
@@ -180,12 +181,12 @@ void ktutil_delete_entry(argc, argv)
     krb5_error_code retval;
 
     if (argc != 2) {
-        fprintf(stderr, "%s: must specify entry to delete\n", argv[0]);
+        fprintf(stderr, _("%s: must specify entry to delete\n"), argv[0]);
         return;
     }
     retval = ktutil_delete(kcontext, &ktlist, atoi(argv[1]));
     if (retval)
-        com_err(argv[0], retval, "while deleting entry %d", atoi(argv[1]));
+        com_err(argv[0], retval, _("while deleting entry %d"), atoi(argv[1]));
 }
 
 void ktutil_list(argc, argv)
@@ -213,9 +214,10 @@ void ktutil_list(argc, argv)
             continue;
         }
 
-        fprintf(stderr, "%s: usage: %s [-t] [-k] [-e]\n", argv[0], argv[0]);
+        fprintf(stderr, _("%s: usage: %s [-t] [-k] [-e]\n"), argv[0], argv[0]);
         return;
     }
+    /* XXX Translating would disturb table alignment; skip for now. */
     if (show_time) {
         printf("slot KVNO Timestamp         Principal\n");
         printf("---- ---- ----------------- ---------------------------------------------------\n");
@@ -251,7 +253,8 @@ void ktutil_list(argc, argv)
             static char buf[256];
             if ((retval = krb5_enctype_to_name(lp->entry->key.enctype, FALSE,
                                                buf, sizeof(buf)))) {
-                com_err(argv[0], retval, "While converting enctype to string");
+                com_err(argv[0], retval,
+                        _("While converting enctype to string"));
                 return;
             }
             printf(" (%s) ", buf);
diff --git a/src/kadmin/ktutil/ktutil_funcs.c b/src/kadmin/ktutil/ktutil_funcs.c
index 91cad6b079..20a348c805 100644
--- a/src/kadmin/ktutil/ktutil_funcs.c
+++ b/src/kadmin/ktutil/ktutil_funcs.c
@@ -159,7 +159,7 @@ krb5_error_code ktutil_add(context, list, princ_str, kvno,
             goto cleanup;
         }
 
-        snprintf(promptstr, sizeof(promptstr), "Password for %.1000s",
+        snprintf(promptstr, sizeof(promptstr), _("Password for %.1000s"),
                  princ_str);
         retval = krb5_read_password(context, promptstr, NULL, password.data,
                                     &password.length);
@@ -176,7 +176,7 @@ krb5_error_code ktutil_add(context, list, princ_str, kvno,
         password.length = 0;
         lp->entry->key = key;
     } else {
-        printf("Key for %s (hex): ", princ_str);
+        printf(_("Key for %s (hex): "), princ_str);
         fgets(buf, BUFSIZ, stdin);
         /*
          * We need to get rid of the trailing '\n' from fgets.
@@ -188,7 +188,7 @@ krb5_error_code ktutil_add(context, list, princ_str, kvno,
          */
         buf[strlen(buf) - 1] = strlen(buf) % 2 ? '\0' : '0';
         if (strlen(buf) == 0) {
-            fprintf(stderr, "addent: Error reading key.\n");
+            fprintf(stderr, _("addent: Error reading key.\n"));
             retval = 0;
             goto cleanup;
         }
@@ -203,7 +203,7 @@ krb5_error_code ktutil_add(context, list, princ_str, kvno,
         i = 0;
         for (cp = buf; *cp; cp += 2) {
             if (!isxdigit((int) cp[0]) || !isxdigit((int) cp[1])) {
-                fprintf(stderr, "addent: Illegal character in key.\n");
+                fprintf(stderr, _("addent: Illegal character in key.\n"));
                 retval = 0;
                 goto cleanup;
             }
diff --git a/src/kadmin/server/ipropd_svc.c b/src/kadmin/server/ipropd_svc.c
index 28c91a819f..d732098a2f 100644
--- a/src/kadmin/server/ipropd_svc.c
+++ b/src/kadmin/server/ipropd_svc.c
@@ -163,7 +163,7 @@ iprop_get_updates_1_svc(kdb_last_t *arg, struct svc_req *rqstp)
 	    free(client_name);
 	    free(service_name);
 	    krb5_klog_syslog(LOG_ERR,
-			     "%s: out of memory recording principal names",
+			     _("%s: out of memory recording principal names"),
 			     whoami);
 	    goto out;
 	}
@@ -290,7 +290,7 @@ ipropx_resync(uint32_t vers, struct svc_req *rqstp)
 	    free(client_name);
 	    free(service_name);
 	    krb5_klog_syslog(LOG_ERR,
-			     "%s: out of memory recording principal names",
+			     _("%s: out of memory recording principal names"),
 			     whoami);
 	    goto out;
 	}
@@ -476,8 +476,9 @@ check_iprop_rpcsec_auth(struct svc_req *rqstp)
      maj_stat = gss_inquire_context(&min_stat, ctx, NULL, &name,
 				    NULL, NULL, NULL, NULL, NULL);
      if (maj_stat != GSS_S_COMPLETE) {
-	  krb5_klog_syslog(LOG_ERR, "check_rpcsec_auth: "
-			   "failed inquire_context, stat=%u", maj_stat);
+	  krb5_klog_syslog(LOG_ERR,
+			   _("check_rpcsec_auth: failed inquire_context, "
+			     "stat=%u"), maj_stat);
 	  log_badauth(maj_stat, min_stat,
 		      &rqstp->rq_xprt->xp_raddr, NULL);
 	  goto fail_name;
@@ -508,8 +509,8 @@ check_iprop_rpcsec_auth(struct svc_req *rqstp)
 
 fail_princ:
      if (!success) {
-	 krb5_klog_syslog(LOG_ERR, "bad service principal %.*s%s",
-			  (int) slen, (char *) gss_str.value, sdots);
+	  krb5_klog_syslog(LOG_ERR, _("bad service principal %.*s%s"),
+			   (int) slen, (char *) gss_str.value, sdots);
      }
      gss_release_buffer(&min_stat, &gss_str);
      krb5_free_principal(kctx, princ);
@@ -531,8 +532,8 @@ krb5_iprop_prog_1(struct svc_req *rqstp,
     char *whoami = "krb5_iprop_prog_1";
 
     if (!check_iprop_rpcsec_auth(rqstp)) {
-	krb5_klog_syslog(LOG_ERR,
-			 "authentication attempt failed: %s, RPC authentication flavor %d",
+	krb5_klog_syslog(LOG_ERR, _("authentication attempt failed: %s, RPC "
+				    "authentication flavor %d"),
 			 inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
 			 rqstp->rq_cred.oa_flavor);
 	svcerr_weakauth(transp);
diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c
index a231d0b1f2..a9bccf5999 100644
--- a/src/kadmin/server/kadm_rpc_svc.c
+++ b/src/kadmin/server/kadm_rpc_svc.c
@@ -4,15 +4,10 @@
  *
  */
 
-#include <stdio.h>
+#include <k5-platform.h>
 #include <gssrpc/rpc.h>
 #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
 #include <syslog.h>
-#include <string.h>
-#include "autoconf.h"
-#ifdef HAVE_MEMORY_H
-#include <memory.h>
-#endif
 #include <kadm5/kadm_rpc.h>
 #include <krb5.h>
 #include <kadm5/admin.h>
@@ -269,8 +264,8 @@ check_rpcsec_auth(struct svc_req *rqstp)
      maj_stat = gss_inquire_context(&min_stat, ctx, NULL, &name,
 				    NULL, NULL, NULL, NULL, NULL);
      if (maj_stat != GSS_S_COMPLETE) {
-	  krb5_klog_syslog(LOG_ERR, "check_rpcsec_auth: "
-			   "failed inquire_context, stat=%u", maj_stat);
+	  krb5_klog_syslog(LOG_ERR, _("check_rpcsec_auth: failed "
+				      "inquire_context, stat=%u"), maj_stat);
 	  log_badauth(maj_stat, min_stat,
 		      &rqstp->rq_xprt->xp_raddr, NULL);
 	  goto fail_name;
@@ -305,7 +300,7 @@ check_rpcsec_auth(struct svc_req *rqstp)
 
 fail_princ:
      if (!success) {
-	 krb5_klog_syslog(LOG_ERR, "bad service principal %.*s%s",
+	 krb5_klog_syslog(LOG_ERR, _("bad service principal %.*s%s"),
 			  (int) slen, (char *) gss_str.value, sdots);
      }
      gss_release_buffer(&min_stat, &gss_str);
@@ -326,9 +321,8 @@ gss_to_krb5_name_1(struct svc_req *rqstp, krb5_context ctx, gss_name_t gss_name,
 
      status = gss_display_name(&minor_stat, gss_name, gss_str, &gss_type);
      if ((status != GSS_S_COMPLETE) || (gss_type != gss_nt_krb5_name)) {
-	  krb5_klog_syslog(LOG_ERR,
-			   "gss_to_krb5_name: "
-			   "failed display_name status %d", status);
+	  krb5_klog_syslog(LOG_ERR, _("gss_to_krb5_name: failed display_name "
+				      "status %d"), status);
 	  log_badauth(status, minor_stat,
 		      &rqstp->rq_xprt->xp_raddr, NULL);
 	  return 0;
diff --git a/src/kadmin/server/ovsec_kadmd.c b/src/kadmin/server/ovsec_kadmd.c
index 4d7a261912..8c11480e8b 100644
--- a/src/kadmin/server/ovsec_kadmd.c
+++ b/src/kadmin/server/ovsec_kadmd.c
@@ -127,15 +127,13 @@ void kadm5_set_use_password_server (void);
 
 static void usage()
 {
-    fprintf(stderr, "Usage: kadmind [-x db_args]* [-r realm] [-m] [-nofork] "
-#ifdef USE_PASSWORD_SERVER
-            "[-passwordserver] "
-#endif
-            "[-port port-number]\n"
-            "\t\t[-P pid_file]\n"
-            "\nwhere,\n\t[-x db_args]* - any number of database specific arguments.\n"
-            "\t\t\tLook at each database documentation for supported arguments\n"
-    );
+    fprintf(stderr, _("Usage: kadmind [-x db_args]* [-r realm] [-m] [-nofork] "
+                      "[-port port-number]\n"
+                      "\t\t[-P pid_file]\n"
+                      "\nwhere,\n\t[-x db_args]* - any number of database "
+                      "specific arguments.\n"
+                      "\t\t\tLook at each database documentation for "
+                      "supported arguments\n"));
     exit(1);
 }
 
@@ -181,8 +179,7 @@ static void display_status_1(m, code, type)
         maj_stat = gss_display_status(&min_stat, code,
                                       type, GSS_C_NULL_OID,
                                       &msg_ctx, &msg);
-        fprintf(stderr, "GSS-API error %s: %s\n", m,
-                (char *)msg.value);
+        fprintf(stderr, _("GSS-API error %s: %s\n"), m, (char *)msg.value);
         (void) gss_release_buffer(&min_stat, &msg);
 
         if (!msg_ctx)
@@ -256,7 +253,7 @@ int main(int argc, char *argv[])
     gssbuf.length = strlen(gssbuf.value);
     major_status = gss_str_to_oid(&minor_status, &gssbuf, &nt_krb5_name_oid);
     if (major_status != GSS_S_COMPLETE) {
-        fprintf(stderr, "Couldn't create KRB5 Name NameType OID\n");
+        fprintf(stderr, _("Couldn't create KRB5 Name NameType OID\n"));
         display_status("str_to_oid", major_status, minor_status);
         exit(1);
     }
@@ -285,8 +282,8 @@ int main(int argc, char *argv[])
                 char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
                 if( temp == NULL )
                 {
-                    fprintf(stderr,"%s: cannot initialize. Not enough memory\n",
-                            whoami);
+                    fprintf(stderr, _("%s: cannot initialize. Not enough "
+                                      "memory\n"), whoami);
                     exit(1);
                 }
                 db_args = temp;
@@ -332,7 +329,7 @@ int main(int argc, char *argv[])
         usage();
 
     if ((ret = kadm5_init_krb5_context(&context))) {
-        fprintf(stderr, "%s: %s while initializing context, aborting\n",
+        fprintf(stderr, _("%s: %s while initializing context, aborting\n"),
                 whoami, error_message(ret));
         exit(1);
     }
@@ -346,9 +343,8 @@ int main(int argc, char *argv[])
                          db_args,
                          &global_server_handle)) != KADM5_OK) {
         const char *e_txt = krb5_get_error_message (context, ret);
-        krb5_klog_syslog(LOG_ERR, "%s while initializing, aborting",
-                         e_txt);
-        fprintf(stderr, "%s: %s while initializing, aborting\n",
+        krb5_klog_syslog(LOG_ERR, _("%s while initializing, aborting"), e_txt);
+        fprintf(stderr, _("%s: %s while initializing, aborting\n"),
                 whoami, e_txt);
         krb5_klog_close(context);
         exit(1);
@@ -357,9 +353,9 @@ int main(int argc, char *argv[])
     if ((ret = kadm5_get_config_params(context, 1, &params,
                                        &params))) {
         const char *e_txt = krb5_get_error_message (context, ret);
-        krb5_klog_syslog(LOG_ERR, "%s: %s while initializing, aborting",
+        krb5_klog_syslog(LOG_ERR, _("%s: %s while initializing, aborting"),
                          whoami, e_txt);
-        fprintf(stderr, "%s: %s while initializing, aborting\n",
+        fprintf(stderr, _("%s: %s while initializing, aborting\n"),
                 whoami, e_txt);
         kadm5_destroy(global_server_handle);
         krb5_klog_close(context);
@@ -369,11 +365,12 @@ int main(int argc, char *argv[])
 #define REQUIRED_PARAMS (KADM5_CONFIG_REALM | KADM5_CONFIG_ACL_FILE)
 
     if ((params.mask & REQUIRED_PARAMS) != REQUIRED_PARAMS) {
-        krb5_klog_syslog(LOG_ERR, "%s: Missing required configuration values "
-                         "(%lx) while initializing, aborting", whoami,
+        krb5_klog_syslog(LOG_ERR,
+                         _("%s: Missing required configuration values "
+                           "(%lx) while initializing, aborting"), whoami,
                          (params.mask & REQUIRED_PARAMS) ^ REQUIRED_PARAMS);
-        fprintf(stderr, "%s: Missing required configuration values "
-                "(%lx) while initializing, aborting\n", whoami,
+        fprintf(stderr, _("%s: Missing required configuration values "
+                          "(%lx) while initializing, aborting\n"), whoami,
                 (params.mask & REQUIRED_PARAMS) ^ REQUIRED_PARAMS);
         krb5_klog_close(context);
         kadm5_destroy(global_server_handle);
@@ -395,9 +392,9 @@ int main(int argc, char *argv[])
 #undef server_handle
         || (ret = setup_network(global_server_handle, whoami, 0))) {
         const char *e_txt = krb5_get_error_message (context, ret);
-        krb5_klog_syslog(LOG_ERR, "%s: %s while initializing network, aborting",
-                         whoami, e_txt);
-        fprintf(stderr, "%s: %s while initializing network, aborting\n",
+        krb5_klog_syslog(LOG_ERR, _("%s: %s while initializing network, "
+                                    "aborting"), whoami, e_txt);
+        fprintf(stderr, _("%s: %s while initializing network, aborting\n"),
                 whoami, e_txt);
         kadm5_destroy(global_server_handle);
         krb5_klog_close(context);
@@ -407,10 +404,9 @@ int main(int argc, char *argv[])
     names[0].name = build_princ_name(KADM5_ADMIN_SERVICE, params.realm);
     names[1].name = build_princ_name(KADM5_CHANGEPW_SERVICE, params.realm);
     if (names[0].name == NULL || names[1].name == NULL) {
-        krb5_klog_syslog(LOG_ERR,
-                         "Cannot build GSS-API authentication names, "
-                         "failing.");
-        fprintf(stderr, "%s: Cannot build GSS-API authentication names.\n",
+        krb5_klog_syslog(LOG_ERR, _("Cannot build GSS-API authentication "
+                                    "names, failing."));
+        fprintf(stderr, _("%s: Cannot build GSS-API authentication names.\n"),
                 whoami);
         kadm5_destroy(global_server_handle);
         krb5_klog_close(context);
@@ -427,34 +423,34 @@ int main(int argc, char *argv[])
     /* Set ktkdb's internal krb5_context. */
     ret = krb5_ktkdb_set_context(hctx);
     if (ret) {
-        krb5_klog_syslog(LOG_ERR, "Can't set kdb keytab's internal context.");
+        krb5_klog_syslog(LOG_ERR,
+                         _("Can't set kdb keytab's internal context."));
         goto kterr;
     }
     ret = krb5_kt_register(context, &krb5_kt_kdb_ops);
     if (ret) {
-        krb5_klog_syslog(LOG_ERR, "Can't register kdb keytab.");
+        krb5_klog_syslog(LOG_ERR, _("Can't register kdb keytab."));
         goto kterr;
     }
     /* Tell gssapi about the kdb keytab. */
     ret = krb5_gss_register_acceptor_identity("KDB:");
     if (ret) {
-        krb5_klog_syslog(LOG_ERR, "Can't register acceptor keytab.");
+        krb5_klog_syslog(LOG_ERR, _("Can't register acceptor keytab."));
         goto kterr;
     }
 kterr:
     if (ret) {
         krb5_klog_syslog(LOG_ERR, "%s", krb5_get_error_message (context, ret));
-        fprintf(stderr, "%s: Can't set up keytab for RPC.\n", whoami);
+        fprintf(stderr, _("%s: Can't set up keytab for RPC.\n"), whoami);
         kadm5_destroy(global_server_handle);
         krb5_klog_close(context);
         exit(1);
     }
 
     if (svcauth_gssapi_set_names(names, 2) == FALSE) {
-        krb5_klog_syslog(LOG_ERR,
-                         "Cannot set GSS-API authentication names (keytab not present?), "
-                         "failing.");
-        fprintf(stderr, "%s: Cannot set GSS-API authentication names.\n",
+        krb5_klog_syslog(LOG_ERR, _("Cannot set GSS-API authentication names "
+                                    "(keytab not present?), failing."));
+        fprintf(stderr, _("%s: Cannot set GSS-API authentication names.\n"),
                 whoami);
         svcauth_gssapi_unset_names();
         kadm5_destroy(global_server_handle);
@@ -477,16 +473,15 @@ kterr:
     svcauth_gss_set_log_miscerr_func(log_miscerr, NULL);
 
     if (svcauth_gss_set_svc_name(GSS_C_NO_NAME) != TRUE) {
-        fprintf(stderr, "%s: Cannot initialize RPCSEC_GSS service name.\n",
+        fprintf(stderr, _("%s: Cannot initialize RPCSEC_GSS service name.\n"),
                 whoami);
         exit(1);
     }
 
     if ((ret = kadm5int_acl_init(context, 0, params.acl_file))) {
         errmsg = krb5_get_error_message (context, ret);
-        krb5_klog_syslog(LOG_ERR, "Cannot initialize acl file: %s",
-                         errmsg);
-        fprintf(stderr, "%s: Cannot initialize acl file: %s\n",
+        krb5_klog_syslog(LOG_ERR, _("Cannot initialize acl file: %s"), errmsg);
+        fprintf(stderr, _("%s: Cannot initialize acl file: %s\n"),
                 whoami, errmsg);
         svcauth_gssapi_unset_names();
         kadm5_destroy(global_server_handle);
@@ -497,9 +492,8 @@ kterr:
     if (!nofork && (ret = daemon(0, 0))) {
         ret = errno;
         errmsg = krb5_get_error_message (context, ret);
-        krb5_klog_syslog(LOG_ERR, "Cannot detach from tty: %s", errmsg);
-        fprintf(stderr, "%s: Cannot detach from tty: %s\n",
-                whoami, errmsg);
+        krb5_klog_syslog(LOG_ERR, _("Cannot detach from tty: %s"), errmsg);
+        fprintf(stderr, _("%s: Cannot detach from tty: %s\n"), whoami, errmsg);
         svcauth_gssapi_unset_names();
         kadm5_destroy(global_server_handle);
         krb5_klog_close(context);
@@ -509,7 +503,7 @@ kterr:
         ret = write_pid_file(pid_file);
         if (ret) {
             errmsg = krb5_get_error_message(context, ret);
-            krb5_klog_syslog(LOG_ERR, "Cannot create PID file %s: %s",
+            krb5_klog_syslog(LOG_ERR, _("Cannot create PID file %s: %s"),
                              pid_file, errmsg);
             svcauth_gssapi_unset_names();
             kadm5_destroy(global_server_handle);
@@ -518,10 +512,10 @@ kterr:
         }
     }
 
-    krb5_klog_syslog(LOG_INFO, "Seeding random number generator");
+    krb5_klog_syslog(LOG_INFO, _("Seeding random number generator"));
     ret = krb5_c_random_os_entropy(context, strong_random, NULL);
     if (ret) {
-        krb5_klog_syslog(LOG_ERR, "Error getting random seed: %s, aborting",
+        krb5_klog_syslog(LOG_ERR, _("Error getting random seed: %s, aborting"),
                          krb5_get_error_message(context, ret));
         svcauth_gssapi_unset_names();
         kadm5_destroy(global_server_handle);
@@ -556,7 +550,7 @@ kterr:
 
         if (nofork)
             fprintf(stderr,
-                    "%s: create IPROP svc (PROG=%d, VERS=%d)\n",
+                    _("%s: create IPROP svc (PROG=%d, VERS=%d)\n"),
                     whoami, KRB5_IPROP_PROG, KRB5_IPROP_VERS);
 
 #if 0
@@ -629,10 +623,10 @@ kterr:
     setup_signal_handlers(log_ctx->iproprole);
     krb5_klog_syslog(LOG_INFO, _("starting"));
     if (nofork)
-        fprintf(stderr, "%s: starting...\n", whoami);
+        fprintf(stderr, _("%s: starting...\n"), whoami);
 
     listen_and_process(global_server_handle, whoami, reset_db);
-    krb5_klog_syslog(LOG_INFO, "finished, exiting");
+    krb5_klog_syslog(LOG_INFO, _("finished, exiting"));
 
     /* Clean up memory, etc */
     svcauth_gssapi_unset_names();
@@ -823,7 +817,7 @@ void reset_db(void)
 
 void request_exit(int signum)
 {
-    krb5_klog_syslog(LOG_DEBUG, "Got signal to request exit");
+    krb5_klog_syslog(LOG_DEBUG, _("Got signal to request exit"));
     signal_requests_exit = 1;
     return;
 }
@@ -839,8 +833,8 @@ void request_exit(int signum)
  */
 void sig_pipe(int unused)
 {
-    krb5_klog_syslog(LOG_NOTICE, "Warning: Received a SIGPIPE; probably a "
-                     "client aborted.  Continuing.");
+    krb5_klog_syslog(LOG_NOTICE, _("Warning: Received a SIGPIPE; probably a "
+                                   "client aborted.  Continuing."));
     return;
 }
 
@@ -968,13 +962,15 @@ void log_badverf(gss_name_t client_name, gss_name_t server_name,
         }
     }
     if (procname != NULL)
-        krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %s, "
-                         "claimed client = %.*s%s, server = %.*s%s, addr = %s",
+        krb5_klog_syslog(LOG_NOTICE,
+                         _("WARNING! Forged/garbled request: %s, claimed "
+                           "client = %.*s%s, server = %.*s%s, addr = %s"),
                          procname, (int) clen, (char *) client.value, cdots,
                          (int) slen, (char *) server.value, sdots, a);
     else
-        krb5_klog_syslog(LOG_NOTICE, "WARNING! Forged/garbled request: %d, "
-                         "claimed client = %.*s%s, server = %.*s%s, addr = %s",
+        krb5_klog_syslog(LOG_NOTICE,
+                         _("WARNING! Forged/garbled request: %d, claimed "
+                           "client = %.*s%s, server = %.*s%s, addr = %s"),
                          proc, (int) clen, (char *) client.value, cdots,
                          (int) slen, (char *) server.value, sdots, a);
 
@@ -1004,7 +1000,8 @@ void log_miscerr(struct svc_req *rqst, struct rpc_msg *msg,
     char *a;
 
     a = inet_ntoa(rqst->rq_xprt->xp_raddr.sin_addr);
-    krb5_klog_syslog(LOG_NOTICE, "Miscellaneous RPC error: %s, %s", a, error);
+    krb5_klog_syslog(LOG_NOTICE, _("Miscellaneous RPC error: %s, %s"), a,
+                     error);
 }
 
 
@@ -1036,10 +1033,10 @@ void log_badauth(OM_uint32 major, OM_uint32 minor,
 
     a = inet_ntoa(addr->sin_addr);
 
-    krb5_klog_syslog(LOG_NOTICE, "Authentication attempt failed: %s, GSS-API "
-                     "error strings are:", a);
+    krb5_klog_syslog(LOG_NOTICE, _("Authentication attempt failed: %s, "
+                                   "GSS-API error strings are:"), a);
     log_badauth_display_status("   ", major, minor);
-    krb5_klog_syslog(LOG_NOTICE, "   GSS-API error strings complete.");
+    krb5_klog_syslog(LOG_NOTICE, _("   GSS-API error strings complete."));
 }
 
 void log_badauth_display_status(char *msg, OM_uint32 major, OM_uint32 minor)
@@ -1066,8 +1063,9 @@ void log_badauth_display_status_1(char *m, OM_uint32 code, int type,
                 log_badauth_display_status_1(m, minor_stat,
                                              GSS_C_MECH_CODE, 1);
             } else
-                krb5_klog_syslog(LOG_ERR, "GSS-API authentication error %.*s: "
-                                 "recursive failure!", (int) msg.length,
+                krb5_klog_syslog(LOG_ERR,
+                                 _("GSS-API authentication error %.*s: "
+                                   "recursive failure!"), (int) msg.length,
                                  (char *) msg.value);
             return;
         }
diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index aef30d16aa..4f7f1104e3 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -299,15 +299,13 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
             targetp = clientstr;
         }
 
-        krb5_klog_syslog(LOG_NOTICE, "setpw request from %s by %.*s%s for %.*s%s: %s",
-                         addrbuf,
-                         (int) clen, clientstr, cdots,
-                         (int) tlen, targetp, tdots,
+        krb5_klog_syslog(LOG_NOTICE, _("setpw request from %s by %.*s%s for "
+                                       "%.*s%s: %s"), addrbuf, (int) clen,
+                         clientstr, cdots, (int) tlen, targetp, tdots,
                          errmsg ? errmsg : "success");
     } else {
-        krb5_klog_syslog(LOG_NOTICE, "chpw request from %s for %.*s%s: %s",
-                         addrbuf,
-                         (int) clen, clientstr, cdots,
+        krb5_klog_syslog(LOG_NOTICE, _("chpw request from %s for %.*s%s: %s"),
+                         addrbuf, (int) clen, clientstr, cdots,
                          errmsg ? errmsg : "success");
     }
     switch (ret) {
@@ -484,7 +482,7 @@ dispatch(void *handle,
 
     ret = krb5_kt_resolve(server_handle->context, "KDB:", &kt);
     if (ret != 0) {
-        krb5_klog_syslog(LOG_ERR, "chpw: Couldn't open admin keytab %s",
+        krb5_klog_syslog(LOG_ERR, _("chpw: Couldn't open admin keytab %s"),
                          krb5_get_error_message(server_handle->context, ret));
         goto cleanup;
     }
diff --git a/src/kadmin/server/server_stubs.c b/src/kadmin/server/server_stubs.c
index 79bd2839fc..6a2ed75511 100644
--- a/src/kadmin/server/server_stubs.c
+++ b/src/kadmin/server/server_stubs.c
@@ -4,6 +4,7 @@
  *
  */
 
+#include <k5-platform.h>
 #include <gssapi/gssapi.h>
 #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
 #include <krb5.h>
@@ -15,10 +16,6 @@
 #include <arpa/inet.h>  /* inet_ntoa */
 #include <adm_proto.h>  /* krb5_klog_syslog */
 #include "misc.h"
-#include <string.h>
-
-#define LOG_UNAUTH  "Unauthorized request: %s, %s, client=%s, service=%s, addr=%s"
-#define LOG_DONE    "Request: %s, %s, %s, client=%s, service=%s, addr=%s"
 
 extern gss_name_t                       gss_changepw_name;
 extern gss_name_t                       gss_oldchangepw_name;
@@ -262,8 +259,8 @@ log_unauth(
 
     /* okay to cast lengths to int because trunc_name limits max value */
     return krb5_klog_syslog(LOG_NOTICE,
-                            "Unauthorized request: %s, %.*s%s, "
-                            "client=%.*s%s, service=%.*s%s, addr=%s",
+                            _("Unauthorized request: %s, %.*s%s, "
+                              "client=%.*s%s, service=%.*s%s, addr=%s"),
                             op, (int)tlen, target, tdots,
                             (int)clen, (char *)client->value, cdots,
                             (int)slen, (char *)server->value, sdots,
@@ -282,6 +279,8 @@ log_done(
     size_t tlen, clen, slen;
     char *tdots, *cdots, *sdots;
 
+    if (errmsg == NULL)
+        errmsg = _("success");
     tlen = strlen(target);
     trunc_name(&tlen, &tdots);
     clen = client->length;
@@ -291,8 +290,8 @@ log_done(
 
     /* okay to cast lengths to int because trunc_name limits max value */
     return krb5_klog_syslog(LOG_NOTICE,
-                            "Request: %s, %.*s%s, %s, "
-                            "client=%.*s%s, service=%.*s%s, addr=%s",
+                            _("Request: %s, %.*s%s, %s, "
+                              "client=%.*s%s, service=%.*s%s, addr=%s"),
                             op, (int)tlen, target, tdots, errmsg,
                             (int)clen, (char *)client->value, cdots,
                             (int)slen, (char *)server->value, sdots,
@@ -345,8 +344,7 @@ create_principal_2_svc(cprinc_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_create_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_create_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -408,8 +406,7 @@ create_principal3_2_svc(cprinc3_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_create_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_create_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -465,8 +462,7 @@ delete_principal_2_svc(dprinc_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_delete_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_delete_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -525,8 +521,7 @@ modify_principal_2_svc(mprinc_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_modify_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_modify_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -599,9 +594,9 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
     if (ret.code != KADM5_OK) {
         /* okay to cast lengths to int because trunc_name limits max value */
         krb5_klog_syslog(LOG_NOTICE,
-                         "Unauthorized request: kadm5_rename_principal, "
-                         "%.*s%s to %.*s%s, "
-                         "client=%.*s%s, service=%.*s%s, addr=%s",
+                         _("Unauthorized request: kadm5_rename_principal, "
+                           "%.*s%s to %.*s%s, "
+                           "client=%.*s%s, service=%.*s%s, addr=%s"),
                          (int)tlen1, prime_arg1, tdots1,
                          (int)tlen2, prime_arg2, tdots2,
                          (int)clen, (char *)client_name.value, cdots,
@@ -615,12 +610,12 @@ rename_principal_2_svc(rprinc_arg *arg, struct svc_req *rqstp)
 
         /* okay to cast lengths to int because trunc_name limits max value */
         krb5_klog_syslog(LOG_NOTICE,
-                         "Request: kadm5_rename_principal, "
-                         "%.*s%s to %.*s%s, %s, "
-                         "client=%.*s%s, service=%.*s%s, addr=%s",
+                         _("Request: kadm5_rename_principal, "
+                           "%.*s%s to %.*s%s, %s, "
+                           "client=%.*s%s, service=%.*s%s, addr=%s"),
                          (int)tlen1, prime_arg1, tdots1,
                          (int)tlen2, prime_arg2, tdots2,
-                         errmsg ? errmsg : "success",
+                         errmsg ? errmsg : _("success"),
                          (int)clen, (char *)client_name.value, cdots,
                          (int)slen, (char *)service_name.value, sdots,
                          inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr));
@@ -686,7 +681,7 @@ get_principal_2_svc(gprinc_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done(funcname, prime_arg, errmsg ? errmsg : "success",
+        log_done(funcname, prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -744,8 +739,7 @@ get_princs_2_svc(gprincs_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_get_principals", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_get_principals", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -807,8 +801,7 @@ chpass_principal_2_svc(chpass_arg *arg, struct svc_req *rqstp)
         if (ret.code != 0)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_chpass_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_chpass_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -877,8 +870,7 @@ chpass_principal3_2_svc(chpass3_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_chpass_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_chpass_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -938,8 +930,7 @@ setv4key_principal_2_svc(setv4key_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_setv4key_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_setv4key_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -999,8 +990,7 @@ setkey_principal_2_svc(setkey_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_setkey_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_setkey_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1063,8 +1053,7 @@ setkey_principal3_2_svc(setkey3_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_setkey_principal", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_setkey_principal", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1137,7 +1126,7 @@ chrand_principal_2_svc(chrand_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done(funcname, prime_arg, errmsg ? errmsg : "success",
+        log_done(funcname, prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1214,7 +1203,7 @@ chrand_principal3_2_svc(chrand3_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done(funcname, prime_arg, errmsg ? errmsg : "success",
+        log_done(funcname, prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1269,8 +1258,7 @@ create_policy_2_svc(cpol_arg *arg, struct svc_req *rqstp)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
         log_done("kadm5_create_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg),
-                 errmsg ? errmsg : "success",
+                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1322,8 +1310,7 @@ delete_policy_2_svc(dpol_arg *arg, struct svc_req *rqstp)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
         log_done("kadm5_delete_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg),
-                 errmsg ? errmsg : "success",
+                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1376,8 +1363,7 @@ modify_policy_2_svc(mpol_arg *arg, struct svc_req *rqstp)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
         log_done("kadm5_modify_policy",
-                 ((prime_arg == NULL) ? "(null)" : prime_arg),
-                 errmsg ? errmsg : "success",
+                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1449,8 +1435,7 @@ get_policy_2_svc(gpol_arg *arg, struct svc_req *rqstp)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
         log_done(funcname,
-                 ((prime_arg == NULL) ? "(null)" : prime_arg),
-                 errmsg ? errmsg : "success",
+                 ((prime_arg == NULL) ? "(null)" : prime_arg), errmsg,
                  &client_name, &service_name, rqstp);
         if (errmsg != NULL)
             krb5_free_error_message(handle->context, errmsg);
@@ -1509,8 +1494,7 @@ get_pols_2_svc(gpols_arg *arg, struct svc_req *rqstp)
         if( ret.code != 0 )
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done("kadm5_get_policies", prime_arg,
-                 errmsg ? errmsg : "success",
+        log_done("kadm5_get_policies", prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1550,8 +1534,7 @@ getprivs_ret * get_privs_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
     if( ret.code != 0 )
         errmsg = krb5_get_error_message(handle->context, ret.code);
 
-    log_done("kadm5_get_privs", client_name.value,
-             errmsg ? errmsg : "success",
+    log_done("kadm5_get_privs", client_name.value, errmsg,
              &client_name, &service_name, rqstp);
 
     if (errmsg != NULL)
@@ -1607,7 +1590,7 @@ purgekeys_2_svc(purgekeys_arg *arg, struct svc_req *rqstp)
         if (ret.code != 0)
             errmsg = krb5_get_error_message(handle->context, ret.code);
 
-        log_done(funcname, prime_arg, errmsg ? errmsg : "success",
+        log_done(funcname, prime_arg, errmsg,
                  &client_name, &service_name, rqstp);
 
         if (errmsg != NULL)
@@ -1655,11 +1638,11 @@ generic_ret *init_2_svc(krb5_ui_4 *arg, struct svc_req *rqstp)
     slen = service_name.length;
     trunc_name(&slen, &sdots);
     /* okay to cast lengths to int because trunc_name limits max value */
-    krb5_klog_syslog(LOG_NOTICE, "Request: kadm5_init, %.*s%s, %s, "
-                     "client=%.*s%s, service=%.*s%s, addr=%s, "
-                     "vers=%d, flavor=%d",
+    krb5_klog_syslog(LOG_NOTICE, _("Request: kadm5_init, %.*s%s, %s, "
+                                   "client=%.*s%s, service=%.*s%s, addr=%s, "
+                                   "vers=%d, flavor=%d"),
                      (int)clen, (char *)client_name.value, cdots,
-                     errmsg ? errmsg : "success",
+                     errmsg ? errmsg : _("success"),
                      (int)clen, (char *)client_name.value, cdots,
                      (int)slen, (char *)service_name.value, sdots,
                      inet_ntoa(rqstp->rq_xprt->xp_raddr.sin_addr),
diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index da01676302..d4bef89330 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -554,7 +554,8 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
                               NULL, /* enc_tkt_request */
                               &enc_tkt_reply);
     if (errcode) {
-        krb5_klog_syslog(LOG_INFO, "AS_REQ : handle_authdata (%d)", errcode);
+        krb5_klog_syslog(LOG_INFO, _("AS_REQ : handle_authdata (%d)"),
+                         errcode);
         status = "HANDLE_AUTHDATA";
         goto errout;
     }
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index f09ae47117..aa3e84fd51 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -684,7 +684,8 @@ tgt_again:
                               subject_tkt,
                               &enc_tkt_reply);
     if (errcode) {
-        krb5_klog_syslog(LOG_INFO, "TGS_REQ : handle_authdata (%d)", errcode);
+        krb5_klog_syslog(LOG_INFO, _("TGS_REQ : handle_authdata (%d)"),
+                         errcode);
         status = "HANDLE_AUTHDATA";
         goto cleanup;
     }
@@ -751,29 +752,24 @@ tgt_again:
         if (errcode == 0) {
             setflag (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED);
         } else if (errcode == KRB5KRB_AP_ERR_ILL_CR_TKT)
-            krb5_klog_syslog (LOG_INFO,
-                              "bad realm transit path from '%s' to '%s' "
-                              "via '%.*s%s'",
-                              cname ? cname : "<unknown client>",
-                              sname ? sname : "<unknown server>",
-                              tlen,
-                              enc_tkt_reply.transited.tr_contents.data,
-                              tdots);
+            krb5_klog_syslog(LOG_INFO, _("bad realm transit path from '%s' "
+                                         "to '%s' via '%.*s%s'"),
+                             cname ? cname : "<unknown client>",
+                             sname ? sname : "<unknown server>", tlen,
+                             enc_tkt_reply.transited.tr_contents.data, tdots);
         else {
             emsg = krb5_get_error_message(kdc_context, errcode);
-            krb5_klog_syslog (LOG_ERR,
-                              "unexpected error checking transit from "
-                              "'%s' to '%s' via '%.*s%s': %s",
-                              cname ? cname : "<unknown client>",
-                              sname ? sname : "<unknown server>",
-                              tlen,
-                              enc_tkt_reply.transited.tr_contents.data,
-                              tdots, emsg);
+            krb5_klog_syslog(LOG_ERR, _("unexpected error checking transit "
+                                        "from '%s' to '%s' via '%.*s%s': %s"),
+                             cname ? cname : "<unknown client>",
+                             sname ? sname : "<unknown server>", tlen,
+                             enc_tkt_reply.transited.tr_contents.data, tdots,
+                             emsg);
             krb5_free_error_message(kdc_context, emsg);
             emsg = NULL;
         }
     } else
-        krb5_klog_syslog (LOG_INFO, "not checking transit path");
+        krb5_klog_syslog(LOG_INFO, _("not checking transit path"));
     if (reject_bad_transit
         && !isflagset (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED)) {
         errcode = KRB5KDC_ERR_POLICY;
diff --git a/src/kdc/fast_util.c b/src/kdc/fast_util.c
index 65e4600b33..52eb997224 100644
--- a/src/kdc/fast_util.c
+++ b/src/kdc/fast_util.c
@@ -59,7 +59,8 @@ static krb5_error_code armor_ap_request
     if (retval != 0) {
         const char * errmsg = krb5_get_error_message(kdc_context, retval);
         krb5_set_error_message(kdc_context, retval,
-                               "%s while handling ap-request armor", errmsg);
+                               _("%s while handling ap-request armor"),
+                               errmsg);
         krb5_free_error_message(kdc_context, errmsg);
     }
     if (retval == 0) {
@@ -67,7 +68,8 @@ static krb5_error_code armor_ap_request
                                               tgs_server,
                                               ticket->server)) {
             krb5_set_error_message(kdc_context, KRB5KDC_ERR_SERVER_NOMATCH,
-                                   "ap-request armor for something other than  the local TGS");
+                                   _("ap-request armor for something other "
+                                     "than the local TGS"));
             retval = KRB5KDC_ERR_SERVER_NOMATCH;
         }
     }
@@ -75,7 +77,7 @@ static krb5_error_code armor_ap_request
         retval = krb5_auth_con_getrecvsubkey(kdc_context, authcontext, &subkey);
         if (retval != 0 || subkey == NULL) {
             krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY,
-                                   "ap-request armor without subkey");
+                                   _("ap-request armor without subkey"));
             retval = KRB5KDC_ERR_POLICY;
         }
     }
@@ -149,16 +151,17 @@ kdc_find_fast(krb5_kdc_req **requestptr,
             switch (fast_armored_req->armor->armor_type) {
             case KRB5_FAST_ARMOR_AP_REQUEST:
                 if (tgs_subkey) {
-                    krb5_set_error_message( kdc_context, KRB5KDC_ERR_PREAUTH_FAILED,
-                                            "Ap-request armor not permitted with TGS");
-                    retval =  KRB5KDC_ERR_PREAUTH_FAILED;
+                    retval = KRB5KDC_ERR_PREAUTH_FAILED;
+                    krb5_set_error_message(kdc_context, retval,
+                                           _("Ap-request armor not permitted "
+                                             "with TGS"));
                     break;
                 }
                 retval = armor_ap_request(state, fast_armored_req->armor);
                 break;
             default:
                 krb5_set_error_message(kdc_context, KRB5KDC_ERR_PREAUTH_FAILED,
-                                       "Unknow FAST armor type %d",
+                                       _("Unknown FAST armor type %d"),
                                        fast_armored_req->armor->armor_type);
                 retval = KRB5KDC_ERR_PREAUTH_FAILED;
             }
@@ -170,9 +173,10 @@ kdc_find_fast(krb5_kdc_req **requestptr,
                                               tgs_session, "ticketarmor",
                                               &state->armor_key);
             else {
-                krb5_set_error_message(kdc_context, KRB5KDC_ERR_PREAUTH_FAILED,
-                                       "No armor key but FAST armored request present");
                 retval = KRB5KDC_ERR_PREAUTH_FAILED;
+                krb5_set_error_message(kdc_context, retval,
+                                       _("No armor key but FAST armored "
+                                         "request present"));
             }
         }
         if (retval == 0) {
@@ -199,14 +203,15 @@ kdc_find_fast(krb5_kdc_req **requestptr,
                                             &cksum_valid);
         if (retval == 0 && !cksum_valid) {
             retval = KRB5KRB_AP_ERR_MODIFIED;
-            krb5_set_error_message(kdc_context, KRB5KRB_AP_ERR_MODIFIED,
-                                   "FAST req_checksum invalid; request modified");
+            krb5_set_error_message(kdc_context, retval,
+                                   _("FAST req_checksum invalid; request "
+                                     "modified"));
         }
         if (retval == 0) {
             if (!krb5_c_is_keyed_cksum(cksum->checksum_type)) {
                 retval = KRB5KDC_ERR_POLICY;
-                krb5_set_error_message(kdc_context, KRB5KDC_ERR_POLICY,
-                                       "Unkeyed checksum used in fast_req");
+                krb5_set_error_message(kdc_context, retval,
+                                       _("Unkeyed checksum used in fast_req"));
             }
         }
         if (retval == 0) {
diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index 2927de12a4..0dc3725a8c 100644
--- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -289,7 +289,7 @@ load_authdata_plugins(krb5_context context)
                 const char *emsg;
                 emsg = krb5_get_error_message(context, initerr);
                 krb5_klog_syslog(LOG_ERR,
-                                 "authdata %s failed to initialize: %s",
+                                 _("authdata %s failed to initialize: %s"),
                                  ftable->name, emsg);
                 krb5_free_error_message(context, emsg);
                 memset(&authdata_systems[k], 0, sizeof(authdata_systems[k]));
@@ -325,7 +325,7 @@ load_authdata_plugins(krb5_context context)
                 const char *emsg;
                 emsg = krb5_get_error_message(context, initerr);
                 krb5_klog_syslog(LOG_ERR,
-                                 "authdata %s failed to initialize: %s",
+                                 _("authdata %s failed to initialize: %s"),
                                  ftable->name, emsg);
                 krb5_free_error_message(context, emsg);
                 memset(&authdata_systems[k], 0, sizeof(authdata_systems[k]));
@@ -782,9 +782,8 @@ handle_authdata (krb5_context context,
             const char *emsg;
 
             emsg = krb5_get_error_message (context, code);
-            krb5_klog_syslog (LOG_INFO,
-                              "authdata (%s) handling failure: %s",
-                              asys->name, emsg);
+            krb5_klog_syslog(LOG_INFO, _("authdata (%s) handling failure: %s"),
+                             asys->name, emsg);
             krb5_free_error_message (context, emsg);
 
             if (asys->flags & AUTHDATA_FLAG_CRITICAL)
diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 59561191d1..8378e997d9 100644
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -458,8 +458,8 @@ load_preauth_plugins(krb5_context context)
                         if (initerr) {
                             const char *emsg;
                             emsg = krb5_get_error_message(context, initerr);
-                            krb5_klog_syslog(LOG_ERR,
-                                             "preauth %s failed to initialize: %s",
+                            krb5_klog_syslog(LOG_ERR, _("preauth %s failed to "
+                                                        "initialize: %s"),
                                              ftable->name, emsg);
                             krb5_free_error_message(context, emsg);
                             memset(&preauth_systems[k], 0,
@@ -949,9 +949,9 @@ get_preauth_hint_list(krb5_kdc_req *request, krb5_db_entry *client,
         pa++;
     }
     if (pa_data[0] == 0) {
-        krb5_klog_syslog (LOG_INFO,
-                          "%spreauth required but hint list is empty",
-                          hw_only ? "hw" : "");
+        krb5_klog_syslog(LOG_INFO,
+                         _("%spreauth required but hint list is empty"),
+                         hw_only ? "hw" : "");
     }
     /*
      * If we fail to get the cookie it is probably
diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
index ed91617fd3..fbf963e42b 100644
--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -225,7 +225,7 @@ kdc_process_tgs_req(krb5_kdc_req *request, const krb5_fulladdr *from,
 
     if (isflagset(apreq->ap_options, AP_OPTS_USE_SESSION_KEY) ||
         isflagset(apreq->ap_options, AP_OPTS_MUTUAL_REQUIRED)) {
-        krb5_klog_syslog(LOG_INFO, "TGS_REQ: SESSION KEY or MUTUAL");
+        krb5_klog_syslog(LOG_INFO, _("TGS_REQ: SESSION KEY or MUTUAL"));
         retval = KRB5KDC_ERR_POLICY;
         goto cleanup;
     }
@@ -307,7 +307,7 @@ kdc_process_tgs_req(krb5_kdc_req *request, const krb5_fulladdr *from,
         !find_pa_data(request->padata, KRB5_PADATA_FOR_USER)) {
         if (is_local_principal((*ticket)->enc_part2->client)) {
             /* someone in a foreign realm claiming to be local */
-            krb5_klog_syslog(LOG_INFO, "PROCESS_TGS: failed lineage check");
+            krb5_klog_syslog(LOG_INFO, _("PROCESS_TGS: failed lineage check"));
             retval = KRB5KDC_ERR_POLICY;
             goto cleanup_authenticator;
         }
@@ -377,8 +377,8 @@ kdc_get_server_key(krb5_ticket *ticket, unsigned int flags,
         char *sname;
         if (!krb5_unparse_name(kdc_context, ticket->server, &sname)) {
             limit_string(sname);
-            krb5_klog_syslog(LOG_ERR,"TGS_REQ: UNKNOWN SERVER: server='%s'",
-                             sname);
+            krb5_klog_syslog(LOG_ERR,
+                             _("TGS_REQ: UNKNOWN SERVER: server='%s'"), sname);
             free(sname);
         }
         return KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
@@ -2247,13 +2247,13 @@ log_as_req(const krb5_fulladdr *from,
         /* success */
         char rep_etypestr[128];
         rep_etypes2str(rep_etypestr, sizeof(rep_etypestr), reply);
-        krb5_klog_syslog(LOG_INFO,
-                         "AS_REQ (%s) %s: ISSUE: authtime %d, %s, %s for %s",
+        krb5_klog_syslog(LOG_INFO, _("AS_REQ (%s) %s: ISSUE: authtime %d, %s, "
+                                     "%s for %s"),
                          ktypestr, fromstring, authtime,
                          rep_etypestr, cname2, sname2);
     } else {
         /* fail */
-        krb5_klog_syslog(LOG_INFO, "AS_REQ (%s) %s: %s: %s for %s%s%s",
+        krb5_klog_syslog(LOG_INFO, _("AS_REQ (%s) %s: %s: %s for %s%s%s"),
                          ktypestr, fromstring, status,
                          cname2, sname2, emsg ? ", " : "", emsg ? emsg : "");
     }
@@ -2301,31 +2301,28 @@ log_tgs_req(const krb5_fulladdr *from,
        name (useful), and doesn't log ktypestr (probably not
        important).  */
     if (errcode != KRB5KDC_ERR_SERVER_NOMATCH) {
-        krb5_klog_syslog(LOG_INFO,
-                         "TGS_REQ (%s) %s: %s: authtime %d, %s%s %s for %s%s%s",
-                         ktypestr,
-                         fromstring, status, authtime,
-                         rep_etypestr,
+        krb5_klog_syslog(LOG_INFO, _("TGS_REQ (%s) %s: %s: authtime %d, %s%s "
+                                     "%s for %s%s%s"),
+                         ktypestr, fromstring, status, authtime, rep_etypestr,
                          !errcode ? "," : "",
                          cname ? cname : "<unknown client>",
                          sname ? sname : "<unknown server>",
-                         errcode ? ", " : "",
-                         errcode ? emsg : "");
+                         errcode ? ", " : "", errcode ? emsg : "");
         if (s4u_name) {
             assert(isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION) ||
                    isflagset(c_flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION));
             if (isflagset(c_flags, KRB5_KDB_FLAG_PROTOCOL_TRANSITION))
                 krb5_klog_syslog(LOG_INFO,
-                                 "... PROTOCOL-TRANSITION s4u-client=%s",
+                                 _("... PROTOCOL-TRANSITION s4u-client=%s"),
                                  s4u_name);
             else if (isflagset(c_flags, KRB5_KDB_FLAG_CONSTRAINED_DELEGATION))
                 krb5_klog_syslog(LOG_INFO,
-                                 "... CONSTRAINED-DELEGATION s4u-client=%s",
+                                 _("... CONSTRAINED-DELEGATION s4u-client=%s"),
                                  s4u_name);
         }
     } else
-        krb5_klog_syslog(LOG_INFO,
-                         "TGS_REQ %s: %s: authtime %d, %s for %s, 2nd tkt client %s",
+        krb5_klog_syslog(LOG_INFO, _("TGS_REQ %s: %s: authtime %d, %s for %s, "
+                                     "2nd tkt client %s"),
                          fromstring, status, authtime,
                          cname ? cname : "<unknown client>",
                          sname ? sname : "<unknown server>",
@@ -2341,10 +2338,10 @@ log_tgs_alt_tgt(krb5_principal p)
     char *sname;
     if (krb5_unparse_name(kdc_context, p, &sname)) {
         krb5_klog_syslog(LOG_INFO,
-                         "TGS_REQ: issuing alternate <un-unparseable> TGT");
+                         _("TGS_REQ: issuing alternate <un-unparseable> TGT"));
     } else {
         limit_string(sname);
-        krb5_klog_syslog(LOG_INFO, "TGS_REQ: issuing TGT %s", sname);
+        krb5_klog_syslog(LOG_INFO, _("TGS_REQ: issuing TGT %s"), sname);
         free(sname);
     }
     /* OpenSolaris: audit_krb5kdc_tgs_req_alt_tgt(...) */
diff --git a/src/kdc/main.c b/src/kdc/main.c
index d58298d802..b2a52dd1a5 100644
--- a/src/kdc/main.c
+++ b/src/kdc/main.c
@@ -299,14 +299,14 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
     }
     kret = krb5int_init_context_kdc(&rdp->realm_context);
     if (kret) {
-        kdc_err(NULL, kret, "while getting context for realm %s", realm);
+        kdc_err(NULL, kret, _("while getting context for realm %s"), realm);
         goto whoops;
     }
 
     kret = krb5_read_realm_params(rdp->realm_context, rdp->realm_name,
                                   &rparams);
     if (kret) {
-        kdc_err(rdp->realm_context, kret, "while reading realm parameters");
+        kdc_err(rdp->realm_context, kret, _("while reading realm parameters"));
         goto whoops;
     }
 
@@ -397,8 +397,8 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
 
     /* Set the default realm of this context */
     if ((kret = krb5_set_default_realm(rdp->realm_context, realm))) {
-        kdc_err(rdp->realm_context, kret, "while setting default realm to %s",
-                realm);
+        kdc_err(rdp->realm_context, kret,
+                _("while setting default realm to %s"), realm);
         goto whoops;
     }
 
@@ -406,7 +406,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
     kdb_open_flags = KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_KDC;
     if ((kret = krb5_db_open(rdp->realm_context, db_args, kdb_open_flags))) {
         kdc_err(rdp->realm_context, kret,
-                "while initializing database for realm %s", realm);
+                _("while initializing database for realm %s"), realm);
         goto whoops;
     }
 
@@ -415,7 +415,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
                                         rdp->realm_name, (char **) NULL,
                                         &rdp->realm_mprinc))) {
         kdc_err(rdp->realm_context, kret,
-                "while setting up master key name %s for realm %s",
+                _("while setting up master key name %s for realm %s"),
                 rdp->realm_mpname, realm);
         goto whoops;
     }
@@ -428,7 +428,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
                                    FALSE, rdp->realm_stash,
                                    &mkvno, NULL, &rdp->realm_mkey))) {
         kdc_err(rdp->realm_context, kret,
-                "while fetching master key %s for realm %s",
+                _("while fetching master key %s for realm %s"),
                 rdp->realm_mpname, realm);
         goto whoops;
     }
@@ -436,7 +436,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
     if ((kret = krb5_db_fetch_mkey_list(rdp->realm_context, rdp->realm_mprinc,
                                         &rdp->realm_mkey, mkvno, &rdp->mkey_list))) {
         kdc_err(rdp->realm_context, kret,
-                "while fetching master keys list for realm %s", realm);
+                _("while fetching master keys list for realm %s"), realm);
         goto whoops;
     }
 
@@ -445,7 +445,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
     if ((kret = krb5_ktkdb_resolve(rdp->realm_context, NULL,
                                    &rdp->realm_keytab))) {
         kdc_err(rdp->realm_context, kret,
-                "while resolving kdb keytab for realm %s", realm);
+                _("while resolving kdb keytab for realm %s"), realm);
         goto whoops;
     }
 
@@ -454,7 +454,7 @@ init_realm(kdc_realm_t *rdp, char *realm, char *def_mpname,
                                      strlen(realm), realm, KRB5_TGS_NAME,
                                      realm, (char *) NULL))) {
         kdc_err(rdp->realm_context, kret,
-                "while building TGS name for realm %s", realm);
+                _("while building TGS name for realm %s"), realm);
         goto whoops;
     }
 
@@ -570,7 +570,7 @@ create_workers(int num)
     pid_t pid, *pids;
 
     /* Create child worker processes; return in each child. */
-    krb5_klog_syslog(LOG_INFO, "creating %d worker processes", num);
+    krb5_klog_syslog(LOG_INFO, _("creating %d worker processes"), num);
     pids = calloc(num, sizeof(pid_t));
     if (pids == NULL)
         return ENOMEM;
@@ -597,7 +597,7 @@ create_workers(int num)
         /* Wait until a worker process exits or we get a signal. */
         pid = wait(&status);
         if (pid >= 0) {
-            krb5_klog_syslog(LOG_ERR, "worker %ld exited with status %d",
+            krb5_klog_syslog(LOG_ERR, _("worker %ld exited with status %d"),
                              (long) pid, status);
 
             /* Remove the pid from the table. */
@@ -620,8 +620,10 @@ create_workers(int num)
             signal_requests_reset = 0;
         }
     }
-    if (signal_requests_exit)
-        krb5_klog_syslog(LOG_INFO, "shutdown signal received in supervisor");
+    if (signal_requests_exit) {
+        krb5_klog_syslog(LOG_INFO,
+                         _("shutdown signal received in supervisor"));
+    }
 
     terminate_workers(pids, num, numleft);
     free(pids);
@@ -638,14 +640,14 @@ static void
 usage(char *name)
 {
     fprintf(stderr,
-            "usage: %s [-x db_args]* [-d dbpathname] [-r dbrealmname]\n"
-            "\t\t[-R replaycachename] [-m] [-k masterenctype]\n"
-            "\t\t[-M masterkeyname] [-p port] [-P pid_file]\n"
-            "\t\t[-n] [-w numworkers] [/]\n\n"
-            "where,\n"
-            "\t[-x db_args]* - Any number of database specific arguments.\n"
-            "\t\t\tLook at each database module documentation for supported\n"
-            "\t\t\targuments\n",
+            _("usage: %s [-x db_args]* [-d dbpathname] [-r dbrealmname]\n"
+              "\t\t[-R replaycachename] [-m] [-k masterenctype]\n"
+              "\t\t[-M masterkeyname] [-p port] [-P pid_file]\n"
+              "\t\t[-n] [-w numworkers] [/]\n\n"
+              "where,\n"
+              "\t[-x db_args]* - Any number of database specific arguments.\n"
+              "\t\t\tLook at each database module documentation for "
+              "\t\t\tsupported arguments\n"),
             name);
     exit(1);
 }
@@ -707,14 +709,14 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
     if (default_udp_ports == 0) {
         default_udp_ports = strdup(DEFAULT_KDC_UDP_PORTLIST);
         if (default_udp_ports == 0) {
-            fprintf(stderr," KDC cannot initialize. Not enough memory\n");
+            fprintf(stderr, _(" KDC cannot initialize. Not enough memory\n"));
             exit(1);
         }
     }
     if (default_tcp_ports == 0) {
         default_tcp_ports = strdup(DEFAULT_KDC_TCP_PORTLIST);
         if (default_tcp_ports == 0) {
-            fprintf(stderr," KDC cannot initialize. Not enough memory\n");
+            fprintf(stderr, _(" KDC cannot initialize. Not enough memory\n"));
             exit(1);
         }
     }
@@ -731,8 +733,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                 char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
                 if( temp == NULL )
                 {
-                    fprintf(stderr,"%s: KDC cannot initialize. Not enough memory\n",
-                            argv[0]);
+                    fprintf(stderr, _("%s: KDC cannot initialize. Not enough "
+                                      "memory\n"), argv[0]);
                     exit(1);
                 }
 
@@ -750,8 +752,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                                              default_tcp_ports, manual,
                                              def_restrict_anon, db_args,
                                              no_refrls, host_based_srvcs))) {
-                        fprintf(stderr,
-                                "%s: cannot initialize realm %s - see log file for details\n",
+                        fprintf(stderr, _("%s: cannot initialize realm %s - "
+                                          "see log file for details\n"),
                                 argv[0], optarg);
                         exit(1);
                     }
@@ -761,8 +763,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                 }
                 else
                 {
-                    fprintf(stderr,"%s: cannot initialize realm %s. Not enough memory\n",
-                            argv[0], optarg);
+                    fprintf(stderr, _("%s: cannot initialize realm %s. Not "
+                                      "enough memory\n"), argv[0], optarg);
                     exit(1);
                 }
             }
@@ -773,9 +775,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
              */
             if( db_name == NULL ) {
                 if (asprintf(&db_name, "dbname=%s", optarg) < 0) {
-                    fprintf(stderr,
-                            "%s: KDC cannot initialize. Not enough memory\n",
-                            argv[0]);
+                    fprintf(stderr, _("%s: KDC cannot initialize. Not enough "
+                                      "memory\n"), argv[0]);
                     exit(1);
                 }
             }
@@ -785,8 +786,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                 char **temp = realloc( db_args, sizeof(char*) * (db_args_size+1)); /* one for NULL */
                 if( temp == NULL )
                 {
-                    fprintf(stderr,"%s: KDC cannot initialize. Not enough memory\n",
-                            argv[0]);
+                    fprintf(stderr, _("%s: KDC cannot initialize. Not enough "
+                                      "memory\n"), argv[0]);
                     exit(1);
                 }
 
@@ -813,7 +814,7 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
             break;
         case 'k':                       /* enctype for master key */
             if (krb5_string_to_enctype(optarg, &menctype))
-                com_err(argv[0], 0, "invalid enctype %s", optarg);
+                com_err(argv[0], 0, _("invalid enctype %s"), optarg);
             break;
         case 'R':
             /* Replay cache name; defunct since we don't use a replay cache. */
@@ -826,7 +827,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                 free(default_udp_ports);
             default_udp_ports = strdup(optarg);
             if (!default_udp_ports) {
-                fprintf(stderr," KDC cannot initialize. Not enough memory\n");
+                fprintf(stderr, _(" KDC cannot initialize. Not enough "
+                                  "memory\n"));
                 exit(1);
             }
 #if 0 /* not yet */
@@ -852,8 +854,9 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
         /* no realm specified, use default realm */
         if ((retval = krb5_get_default_realm(kcontext, &lrealm))) {
             com_err(argv[0], retval,
-                    "while attempting to retrieve default realm");
-            fprintf (stderr, "%s: %s, attempting to retrieve default realm\n",
+                    _("while attempting to retrieve default realm"));
+            fprintf (stderr,
+                     _("%s: %s, attempting to retrieve default realm\n"),
                      argv[0], krb5_get_error_message(kcontext, retval));
             exit(1);
         }
@@ -862,8 +865,8 @@ initialize_realms(krb5_context kcontext, int argc, char **argv)
                                      default_udp_ports, default_tcp_ports,
                                      manual, def_restrict_anon, db_args,
                                      no_refrls, host_based_srvcs))) {
-                fprintf(stderr,"%s: cannot initialize realm %s - see log file for details\n",
-                        argv[0], lrealm);
+                fprintf(stderr, _("%s: cannot initialize realm %s - see log "
+                                  "file for details\n"), argv[0], lrealm);
                 exit(1);
             }
             kdc_realmlist[0] = rdatap;
@@ -955,7 +958,7 @@ int main(int argc, char **argv)
 
     if (!(kdc_realmlist = (kdc_realm_t **) malloc(sizeof(kdc_realm_t *) *
                                                   KRB5_KDC_MAX_REALMS))) {
-        fprintf(stderr, "%s: cannot get memory for realm list\n", argv[0]);
+        fprintf(stderr, _("%s: cannot get memory for realm list\n"), argv[0]);
         exit(1);
     }
     memset(kdc_realmlist, 0,
@@ -969,7 +972,7 @@ int main(int argc, char **argv)
      */
     retval = krb5int_init_context_kdc(&kcontext);
     if (retval) {
-        com_err(argv[0], retval, "while initializing krb5");
+        com_err(argv[0], retval, _("while initializing krb5"));
         exit(1);
     }
     krb5_klog_init(kcontext, "kdc", argv[0], 1);
@@ -994,7 +997,7 @@ int main(int argc, char **argv)
 
     retval = setup_sam();
     if (retval) {
-        kdc_err(kcontext, retval, "while initializing SAM");
+        kdc_err(kcontext, retval, _("while initializing SAM"));
         finish_realms();
         return 1;
     }
@@ -1039,19 +1042,19 @@ int main(int argc, char **argv)
      */
     if ((retval = setup_network(NULL, kdc_progname, (workers > 0)))) {
     net_init_error:
-        kdc_err(kcontext, retval, "while initializing network");
+        kdc_err(kcontext, retval, _("while initializing network"));
         finish_realms();
         return 1;
     }
     if (!nofork && daemon(0, 0)) {
-        kdc_err(kcontext, errno, "while detaching from tty");
+        kdc_err(kcontext, errno, _("while detaching from tty"));
         finish_realms();
         return 1;
     }
     if (pid_file != NULL) {
         retval = write_pid_file(pid_file);
         if (retval) {
-            kdc_err(kcontext, retval, "while creating PID file");
+            kdc_err(kcontext, retval, _("while creating PID file"));
             finish_realms();
             return 1;
         }
@@ -1060,21 +1063,21 @@ int main(int argc, char **argv)
         finish_realms();
         retval = create_workers(workers);
         if (retval) {
-            kdc_err(kcontext, errno, "creating worker processes");
+            kdc_err(kcontext, errno, _("creating worker processes"));
             return 1;
         }
         /* We get here only in a worker child process; re-initialize realms. */
         initialize_realms(kcontext, argc, argv);
     }
-    krb5_klog_syslog(LOG_INFO, "commencing operation");
+    krb5_klog_syslog(LOG_INFO, _("commencing operation"));
     if (nofork)
-        fprintf(stderr, "%s: starting...\n", kdc_progname);
+        fprintf(stderr, _("%s: starting...\n"), kdc_progname);
     if ((retval = listen_and_process(0, kdc_progname, reset_for_hangup))) {
-        kdc_err(kcontext, retval, "while processing network requests");
+        kdc_err(kcontext, retval, _("while processing network requests"));
         errout++;
     }
     closedown_network();
-    krb5_klog_syslog(LOG_INFO, "shutting down");
+    krb5_klog_syslog(LOG_INFO, _("shutting down"));
     unload_preauth_plugins(kcontext);
     unload_authdata_plugins(kcontext);
     krb5_klog_close(kdc_context);
diff --git a/src/lib/apputils/net-server.c b/src/lib/apputils/net-server.c
index abb94dd919..a1bbaa559e 100644
--- a/src/lib/apputils/net-server.c
+++ b/src/lib/apputils/net-server.c
@@ -365,7 +365,7 @@ add_fd(struct socksetup *data, int sock, enum conn_type conntype,
     if (sock >= FD_SETSIZE) {
         data->retval = EMFILE;  /* XXX */
         com_err(data->prog, 0,
-                "file descriptor number %d too high", sock);
+                _("file descriptor number %d too high"), sock);
         return 0;
     }
 #endif
@@ -373,12 +373,12 @@ add_fd(struct socksetup *data, int sock, enum conn_type conntype,
     if (newconn == NULL) {
         data->retval = ENOMEM;
         com_err(data->prog, ENOMEM,
-                "cannot allocate storage for connection info");
+                _("cannot allocate storage for connection info"));
         return 0;
     }
     if (!ADD(connections, newconn, tmp)) {
         data->retval = ENOMEM;
-        com_err(data->prog, ENOMEM, "cannot save socket info");
+        com_err(data->prog, ENOMEM, _("cannot save socket info"));
         free(newconn);
         return 0;
     }
@@ -447,7 +447,7 @@ create_server_socket(struct socksetup *data, struct sockaddr *addr, int type)
     sock = socket(addr->sa_family, type, 0);
     if (sock == -1) {
         data->retval = errno;
-        com_err(data->prog, errno, "Cannot create TCP server socket on %s",
+        com_err(data->prog, errno, _("Cannot create TCP server socket on %s"),
                 paddr(addr));
         return -1;
     }
@@ -456,7 +456,7 @@ create_server_socket(struct socksetup *data, struct sockaddr *addr, int type)
 #ifndef _WIN32                  /* Windows FD_SETSIZE is a count. */
     if (sock >= FD_SETSIZE) {
         close(sock);
-        com_err(data->prog, 0, "TCP socket fd number %d (for %s) too high",
+        com_err(data->prog, 0, _("TCP socket fd number %d (for %s) too high"),
                 sock, paddr(addr));
         return -1;
     }
@@ -464,27 +464,27 @@ create_server_socket(struct socksetup *data, struct sockaddr *addr, int type)
 
     if (setreuseaddr(sock, 1) < 0) {
         com_err(data->prog, errno,
-                "Cannot enable SO_REUSEADDR on fd %d", sock);
+                _("Cannot enable SO_REUSEADDR on fd %d"), sock);
     }
 
 #ifdef KRB5_USE_INET6
     if (addr->sa_family == AF_INET6) {
 #ifdef IPV6_V6ONLY
         if (setv6only(sock, 1))
-            com_err(data->prog, errno, "setsockopt(%d,IPV6_V6ONLY,1) failed",
-                    sock);
+            com_err(data->prog, errno,
+                    _("setsockopt(%d,IPV6_V6ONLY,1) failed"), sock);
         else
-            com_err(data->prog, 0, "setsockopt(%d,IPV6_V6ONLY,1) worked",
+            com_err(data->prog, 0, _("setsockopt(%d,IPV6_V6ONLY,1) worked"),
                     sock);
 #else
-        krb5_klog_syslog(LOG_INFO, "no IPV6_V6ONLY socket option support");
+        krb5_klog_syslog(LOG_INFO, _("no IPV6_V6ONLY socket option support"));
 #endif /* IPV6_V6ONLY */
     }
 #endif /* KRB5_USE_INET6 */
 
     if (bind(sock, addr, socklen(addr)) == -1) {
         data->retval = errno;
-        com_err(data->prog, errno, "Cannot bind server socket on %s",
+        com_err(data->prog, errno, _("Cannot bind server socket on %s"),
                 paddr(addr));
         close(sock);
         return -1;
@@ -504,7 +504,8 @@ add_rpc_listener_fd(struct socksetup *data, struct rpc_svc_data *svc, int sock)
 
     conn->u.rpc.transp = svctcp_create(sock, 0, 0);
     if (conn->u.rpc.transp == NULL) {
-        krb5_klog_syslog(LOG_ERR, "Cannot create RPC service: %s; continuing",
+        krb5_klog_syslog(LOG_ERR,
+                         _("Cannot create RPC service: %s; continuing"),
                          strerror(errno));
         delete_fd(conn);
         return NULL;
@@ -512,7 +513,8 @@ add_rpc_listener_fd(struct socksetup *data, struct rpc_svc_data *svc, int sock)
 
     if (!svc_register(conn->u.rpc.transp, svc->prognum, svc->versnum,
                       svc->dispatch, 0)) {
-        krb5_klog_syslog(LOG_ERR, "Cannot register RPC service: %s; continuing",
+        krb5_klog_syslog(LOG_ERR,
+                         _("Cannot register RPC service: %s; continuing"),
                          strerror(errno));
         delete_fd(conn);
         return NULL;
@@ -558,21 +560,21 @@ setup_a_tcp_listener(struct socksetup *data, struct sockaddr *addr)
     if (sock == -1)
         return -1;
     if (listen(sock, 5) < 0) {
-        com_err(data->prog, errno, "Cannot listen on TCP server socket on %s",
-                paddr(addr));
+        com_err(data->prog, errno,
+                _("Cannot listen on TCP server socket on %s"), paddr(addr));
         close(sock);
         return -1;
     }
     if (setnbio(sock)) {
         com_err(data->prog, errno,
-                "cannot set listening tcp socket on %s non-blocking",
+                _("cannot set listening tcp socket on %s non-blocking"),
                 paddr(addr));
         close(sock);
         return -1;
     }
     if (setnolinger(sock)) {
-        com_err(data->prog, errno, "disabling SO_LINGER on TCP socket on %s",
-                paddr(addr));
+        com_err(data->prog, errno,
+                _("disabling SO_LINGER on TCP socket on %s"), paddr(addr));
         close(sock);
         return -1;
     }
@@ -637,7 +639,7 @@ setup_tcp_listener_ports(struct socksetup *data)
                 FD_SET(s4, &sstate.rfds);
                 if (s4 >= sstate.max)
                     sstate.max = s4 + 1;
-                krb5_klog_syslog(LOG_INFO, "listening on fd %d: tcp %s",
+                krb5_klog_syslog(LOG_INFO, _("listening on fd %d: tcp %s"),
                                  s4, paddr((struct sockaddr *)&sin4));
             }
         }
@@ -650,12 +652,12 @@ setup_tcp_listener_ports(struct socksetup *data)
                 FD_SET(s6, &sstate.rfds);
                 if (s6 >= sstate.max)
                     sstate.max = s6 + 1;
-                krb5_klog_syslog(LOG_INFO, "listening on fd %d: tcp %s",
+                krb5_klog_syslog(LOG_INFO, _("listening on fd %d: tcp %s"),
                                  s6, paddr((struct sockaddr *)&sin6));
             }
             if (s4 < 0)
                 krb5_klog_syslog(LOG_INFO,
-                                 "assuming IPv6 socket accepts IPv4");
+                                 _("assuming IPv6 socket accepts IPv4"));
         }
 #endif
     }
@@ -705,7 +707,7 @@ setup_rpc_listener_ports(struct socksetup *data)
             FD_SET(s4, &sstate.rfds);
             if (s4 >= sstate.max)
                 sstate.max = s4 + 1;
-            krb5_klog_syslog(LOG_INFO, "listening on fd %d: rpc %s",
+            krb5_klog_syslog(LOG_INFO, _("listening on fd %d: rpc %s"),
                              s4, paddr((struct sockaddr *)&sin4));
         }
 
@@ -723,7 +725,7 @@ setup_rpc_listener_ports(struct socksetup *data)
                 FD_SET(s6, &sstate.rfds);
                 if (s6 >= sstate.max)
                     sstate.max = s6 + 1;
-                krb5_klog_syslog(LOG_INFO, "listening on fd %d: rpc %s",
+                krb5_klog_syslog(LOG_INFO, _("listening on fd %d: rpc %s"),
                                  s6, paddr((struct sockaddr *)&sin6));
             }
         }
@@ -812,15 +814,16 @@ setup_udp_port_1(struct socksetup *data, struct sockaddr *addr,
         if (pktinfo) {
             r = set_pktinfo(sock, addr->sa_family);
             if (r) {
-                com_err(data->prog, r, "Cannot request packet info for "
-                        "udp socket address %s port %d", haddrbuf, port);
+                com_err(data->prog, r,
+                        _("Cannot request packet info for udp socket address "
+                          "%s port %d"), haddrbuf, port);
                 close(sock);
                 return 1;
             }
         }
-        krb5_klog_syslog (LOG_INFO, "listening on fd %d: udp %s%s", sock,
-                          paddr((struct sockaddr *)addr),
-                          pktinfo ? " (pktinfo)" : "");
+        krb5_klog_syslog(LOG_INFO, _("listening on fd %d: udp %s%s"), sock,
+                         paddr((struct sockaddr *)addr),
+                         pktinfo ? " (pktinfo)" : "");
         if (add_udp_fd (data, sock, pktinfo) == 0) {
             close(sock);
             return 1;
@@ -861,7 +864,7 @@ setup_udp_port(void *P_data, struct sockaddr *addr)
         {
             static int first = 1;
             if (first) {
-                krb5_klog_syslog (LOG_INFO, "skipping local ipv6 addresses");
+                krb5_klog_syslog(LOG_INFO, _("skipping local ipv6 addresses"));
                 first = 0;
             }
             return 0;
@@ -881,9 +884,9 @@ setup_udp_port(void *P_data, struct sockaddr *addr)
         return 0;
 #endif
     default:
-        krb5_klog_syslog (LOG_INFO,
-                          "skipping unrecognized local address family %d",
-                          addr->sa_family);
+        krb5_klog_syslog(LOG_INFO,
+                         _("skipping unrecognized local address family %d"),
+                         addr->sa_family);
         return 0;
     }
     return setup_udp_port_1(data, addr, haddrbuf, 0);
@@ -984,14 +987,14 @@ process_routing_update(void *handle, struct connection *conn, const char *prog,
                 n_read < RS(rtm_version) ||
                 n_read < RS(rtm_msglen)) {
                 krb5_klog_syslog(LOG_ERR,
-                                 "short read (%d/%d) from routing socket",
+                                 _("short read (%d/%d) from routing socket"),
                                  n_read, (int) sizeof(rtm));
                 return;
             }
         }
 #if 0
         krb5_klog_syslog(LOG_INFO,
-                         "got routing msg type %d(%s) v%d",
+                         _("got routing msg type %d(%s) v%d"),
                          rtm.rtm_type, rtm_type_name(rtm.rtm_type),
                          rtm.rtm_version);
 #endif
@@ -1000,7 +1003,7 @@ process_routing_update(void *handle, struct connection *conn, const char *prog,
                thrown away?  */
         } else if (rtm.rtm_msglen != n_read) {
             krb5_klog_syslog(LOG_ERR,
-                             "read %d from routing socket but msglen is %d",
+                             _("read %d from routing socket but msglen is %d"),
                              n_read, rtm.rtm_msglen);
         }
         switch (rtm.rtm_type) {
@@ -1057,8 +1060,9 @@ process_routing_update(void *handle, struct connection *conn, const char *prog,
 #endif
             break;
         default:
-            krb5_klog_syslog(LOG_INFO, "unhandled routing message type %d, "
-                             "will reconfigure just for the fun of it",
+            krb5_klog_syslog(LOG_INFO,
+                             _("unhandled routing message type %d, "
+                               "will reconfigure just for the fun of it"),
                              rtm.rtm_type);
             network_reconfiguration_needed = 1;
             break;
@@ -1072,10 +1076,10 @@ setup_routing_socket(struct socksetup *data)
     int sock = socket(PF_ROUTE, SOCK_RAW, 0);
     if (sock < 0) {
         int e = errno;
-        krb5_klog_syslog(LOG_INFO, "couldn't set up routing socket: %s",
+        krb5_klog_syslog(LOG_INFO, _("couldn't set up routing socket: %s"),
                          strerror(e));
     } else {
-        krb5_klog_syslog(LOG_INFO, "routing socket is fd %d", sock);
+        krb5_klog_syslog(LOG_INFO, _("routing socket is fd %d"), sock);
         add_fd(data, sock, CONN_ROUTING, process_routing_update);
         setnbio(sock);
         FD_SET(sock, &sstate.rfds);
@@ -1102,7 +1106,7 @@ setup_network(void *handle, const char *prog, int no_reconfig)
 
     setup_data.prog = prog;
     setup_data.retval = 0;
-    krb5_klog_syslog (LOG_INFO, "setting up network...");
+    krb5_klog_syslog(LOG_INFO, _("setting up network..."));
 #ifdef HAVE_STRUCT_RT_MSGHDR
     if (!no_reconfig)
         setup_routing_socket(&setup_data);
@@ -1122,9 +1126,9 @@ setup_network(void *handle, const char *prog, int no_reconfig)
     }
     setup_tcp_listener_ports(&setup_data);
     setup_rpc_listener_ports(&setup_data);
-    krb5_klog_syslog (LOG_INFO, "set up %d sockets", (int)n_sockets);
+    krb5_klog_syslog (LOG_INFO, _("set up %d sockets"), (int)n_sockets);
     if (n_sockets == 0) {
-        com_err(prog, 0, "no sockets set up?");
+        com_err(prog, 0, _("no sockets set up?"));
         exit (1);
     }
 
@@ -1386,7 +1390,7 @@ process_packet(void *handle, struct connection *conn, const char *prog,
              */
             && errno != ECONNREFUSED
         )
-            com_err(prog, errno, "while receiving from network");
+            com_err(prog, errno, _("while receiving from network"));
         return;
     }
     if (!cc)
@@ -1421,7 +1425,7 @@ process_packet(void *handle, struct connection *conn, const char *prog,
     /* This address is in net order. */
     retval = dispatch(handle, ss2sa(&daddr), &faddr, &request, &response, 0);
     if (retval) {
-        com_err(prog, retval, "while dispatching (udp)");
+        com_err(prog, retval, _("while dispatching (udp)"));
         return;
     }
     if (response == NULL)
@@ -1448,12 +1452,12 @@ process_packet(void *handle, struct connection *conn, const char *prog,
             strlcpy(saddrbuf, "?", sizeof(saddrbuf));
             strlcpy(sportbuf, "?", sizeof(sportbuf));
         }
-        com_err(prog, e, "while sending reply to %s/%s from %s",
+        com_err(prog, e, _("while sending reply to %s/%s from %s"),
                 saddrbuf, sportbuf, daddrbuf);
         return;
     }
     if ((size_t)cc != response->length) {
-        com_err(prog, 0, "short reply write %d vs %d\n",
+        com_err(prog, 0, _("short reply write %d vs %d\n"),
                 response->length, cc);
     }
     krb5_free_data(get_context(handle), response);
@@ -1473,7 +1477,7 @@ kill_lru_tcp_or_rpc_connection(void *handle, struct connection *newconn)
     struct connection *c;
     int i, fd = -1;
 
-    krb5_klog_syslog(LOG_INFO, "too many connections");
+    krb5_klog_syslog(LOG_INFO, _("too many connections"));
 
     FOREACH_ELT (connections, i, c) {
         if (c->type != CONN_TCP && c->type != CONN_RPC)
@@ -1489,7 +1493,7 @@ kill_lru_tcp_or_rpc_connection(void *handle, struct connection *newconn)
             oldest_tcp = c;
     }
     if (oldest_tcp != NULL) {
-        krb5_klog_syslog(LOG_INFO, "dropping %s fd %d from %s",
+        krb5_klog_syslog(LOG_INFO, _("dropping %s fd %d from %s"),
                          c->type == CONN_RPC ? "rpc" : "tcp",
                          oldest_tcp->fd, oldest_tcp->u.tcp.addrbuf);
         fd = oldest_tcp->fd;
@@ -1559,7 +1563,8 @@ accept_tcp_connection(void *handle, struct connection *conn, const char *prog,
         kill_lru_tcp_or_rpc_connection(handle, newconn);
 
     if (newconn->u.tcp.buffer == 0) {
-        com_err(prog, errno, "allocating buffer for new TCP session from %s",
+        com_err(prog, errno,
+                _("allocating buffer for new TCP session from %s"),
                 newconn->u.tcp.addrbuf);
         delete_fd(newconn);
         close(s);
@@ -1616,7 +1621,7 @@ kill_tcp_or_rpc_connection(void *handle, struct connection *conn,
 
         if (FD_ISSET(conn->fd, &svc_fdset)) {
             krb5_klog_syslog(LOG_ERR,
-                             "descriptor %d closed but still in svc_fdset",
+                             _("descriptor %d closed but still in svc_fdset"),
                              conn->fd);
         }
     }
@@ -1707,15 +1712,17 @@ process_tcp_connection(void *handle, struct connection *conn, const char *prog,
                 if (conn->u.tcp.msglen > conn->u.tcp.bufsiz - 4) {
                     krb5_error_code err;
                     /* Message too big. */
-                    krb5_klog_syslog(LOG_ERR, "TCP client %s wants %lu bytes, "
-                                     "cap is %lu", conn->u.tcp.addrbuf,
+                    krb5_klog_syslog(LOG_ERR,
+                                     _("TCP client %s wants %lu bytes, "
+                                       "cap is %lu"), conn->u.tcp.addrbuf,
                                      (unsigned long) conn->u.tcp.msglen,
                                      (unsigned long) conn->u.tcp.bufsiz - 4);
                     /* XXX Should return an error.  */
                     err = make_toolong_error (handle, &conn->u.tcp.response);
                     if (err) {
-                        krb5_klog_syslog(LOG_ERR, "error constructing "
-                                         "KRB_ERR_FIELD_TOOLONG error! %s",
+                        krb5_klog_syslog(LOG_ERR,
+                                         _("error constructing "
+                                           "KRB_ERR_FIELD_TOOLONG error! %s"),
                                          error_message(err));
                         goto kill_tcp_connection;
                     }
@@ -1751,7 +1758,7 @@ process_tcp_connection(void *handle, struct connection *conn, const char *prog,
             err = dispatch(handle, local_saddrp, &conn->u.tcp.faddr,
                            &request, &conn->u.tcp.response, 1);
             if (err) {
-                com_err(prog, err, "while dispatching (tcp)");
+                com_err(prog, err, _("while dispatching (tcp)"));
                 goto kill_tcp_connection;
             }
             if (conn->u.tcp.response == NULL)
@@ -1814,13 +1821,15 @@ listen_and_process(void *handle, const char *prog, void (*reset)(void))
 
         if (network_reconfiguration_needed) {
             /* No point in re-logging what we've just logged. */
-            if (netchanged == 0)
-                krb5_klog_syslog(LOG_INFO, "network reconfiguration needed");
+            if (netchanged == 0) {
+                krb5_klog_syslog(LOG_INFO,
+                                 _("network reconfiguration needed"));
+            }
             /* It might be tidier to add a timer-callback interface to the
              * control loop, but for this one use, it's not a big deal. */
             err = getcurtime(&sstate.end_time);
             if (err) {
-                com_err(prog, err, "while getting the time");
+                com_err(prog, err, _("while getting the time"));
                 continue;
             }
             sstate.end_time.tv_sec += 3;
@@ -1831,7 +1840,7 @@ listen_and_process(void *handle, const char *prog, void (*reset)(void))
         err = krb5int_cm_call_select(&sstate, &sout, &sret);
         if (err) {
             if (err != EINTR)
-                com_err(prog, err, "while selecting for network input(1)");
+                com_err(prog, err, _("while selecting for network input(1)"));
             continue;
         }
         if (sret == 0 && netchanged) {
@@ -1839,14 +1848,16 @@ listen_and_process(void *handle, const char *prog, void (*reset)(void))
             closedown_network_sockets();
             err = setup_network(handle, prog, 0);
             if (err) {
-                com_err(prog, err, "while reinitializing network");
+                com_err(prog, err, _("while reinitializing network"));
                 return err;
             }
             netchanged = 0;
         }
         if (sret == -1) {
-            if (errno != EINTR)
-                com_err(prog, errno, "while selecting for network input(2)");
+            if (errno != EINTR) {
+                com_err(prog, errno,
+                        _("while selecting for network input(2)"));
+            }
             continue;
         }
         nfound = sret;
@@ -1862,7 +1873,7 @@ listen_and_process(void *handle, const char *prog, void (*reset)(void))
                 service_conn(handle, conns[i], prog, sflags);
         }
     }
-    krb5_klog_syslog(LOG_INFO, "shutdown signal received");
+    krb5_klog_syslog(LOG_INFO, _("shutdown signal received"));
     return 0;
 }
 
@@ -1877,7 +1888,7 @@ closedown_network_sockets()
 
     FOREACH_ELT (connections, i, conn) {
         if (conn->fd >= 0) {
-            krb5_klog_syslog(LOG_INFO, "closing down fd %d", conn->fd);
+            krb5_klog_syslog(LOG_INFO, _("closing down fd %d"), conn->fd);
             (void) close(conn->fd);
             if (conn->type == CONN_RPC) {
                 fd_set fds;
diff --git a/src/lib/crypto/krb/cf2.c b/src/lib/crypto/krb/cf2.c
index 7c2e965125..5f82d62afd 100644
--- a/src/lib/crypto/krb/cf2.c
+++ b/src/lib/crypto/krb/cf2.c
@@ -111,7 +111,7 @@ krb5_c_fx_cf2_simple(krb5_context context,
     if (out_enctype->prf == NULL) {
         if (context)
             krb5int_set_error(&(context->err), KRB5_CRYPTO_INTERNAL,
-                              "Enctype %d has no PRF", out_enctype_num);
+                              _("Enctype %d has no PRF"), out_enctype_num);
         return KRB5_CRYPTO_INTERNAL;
     }
     keybytes = out_enctype->enc->keybytes;
diff --git a/src/lib/gssapi/generic/disp_major_status.c b/src/lib/gssapi/generic/disp_major_status.c
index 5098e3abd4..e4ff722c9c 100644
--- a/src/lib/gssapi/generic/disp_major_status.c
+++ b/src/lib/gssapi/generic/disp_major_status.c
@@ -34,18 +34,18 @@
 
 #define GSS_ERROR_STR(value, array, select, min, max, num)              \
     (((select(value) < (min)) || (select(value) > (max))) ? NULL :      \
-     (array)[num(value)])
+     _((array)[num(value)]))
 
 /**/
 
 static const char * const calling_error_string[] = {
     NULL,
-    "A required input parameter could not be read",
-    "A required input parameter could not be written",
-    "A parameter was malformed",
+    N_("A required input parameter could not be read"),
+    N_("A required input parameter could not be written"),
+    N_("A parameter was malformed"),
 };
 
-static const char * const calling_error = "calling error";
+static const char * const calling_error = N_("calling error");
 
 #define GSS_CALLING_ERROR_STR(x)                                        \
     GSS_ERROR_STR((x), calling_error_string, GSS_CALLING_ERROR,         \
@@ -56,25 +56,25 @@ static const char * const calling_error = "calling error";
 
 static const char * const routine_error_string[] = {
     NULL,
-    "An unsupported mechanism was requested",
-    "An invalid name was supplied",
-    "A supplied name was of an unsupported type",
-    "Incorrect channel bindings were supplied",
-    "An invalid status code was supplied",
-    "A token had an invalid signature",
-    "No credentials were supplied",
-    "No context has been established",
-    "A token was invalid",
-    "A credential was invalid",
-    "The referenced credentials have expired",
-    "The context has expired",
-    "Miscellaneous failure",
-    "The quality-of-protection requested could not be provided",
-    "The operation is forbidden by the local security policy",
-    "The operation or option is not available",
+    N_("An unsupported mechanism was requested"),
+    N_("An invalid name was supplied"),
+    N_("A supplied name was of an unsupported type"),
+    N_("Incorrect channel bindings were supplied"),
+    N_("An invalid status code was supplied"),
+    N_("A token had an invalid signature"),
+    N_("No credentials were supplied"),
+    N_("No context has been established"),
+    N_("A token was invalid"),
+    N_("A credential was invalid"),
+    N_("The referenced credentials have expired"),
+    N_("The context has expired"),
+    N_("Miscellaneous failure"),
+    N_("The quality-of-protection requested could not be provided"),
+    N_("The operation is forbidden by the local security policy"),
+    N_("The operation or option is not available"),
 };
 
-static const char * const routine_error = "routine error";
+static const char * const routine_error = N_("routine error");
 
 #define GSS_ROUTINE_ERROR_STR(x)                                \
     GSS_ERROR_STR((x), routine_error_string, GSS_ROUTINE_ERROR, \
@@ -86,13 +86,13 @@ static const char * const routine_error = "routine error";
 /* this becomes overly gross after about 4 strings */
 
 static const char * const sinfo_string[] = {
-    "The routine must be called again to complete its function",
-    "The token was a duplicate of an earlier token",
-    "The token's validity period has expired",
-    "A later token has already been processed",
+    N_("The routine must be called again to complete its function"),
+    N_("The token was a duplicate of an earlier token"),
+    N_("The token's validity period has expired"),
+    N_("A later token has already been processed"),
 };
 
-static const char * const sinfo_code = "supplementary info code";
+static const char * const sinfo_code = N_("supplementary info code");
 
 #define LSBGET(x) ((((x)^((x)-1))+1)>>1)
 #define LSBMASK(n) ((1<<(n))^((1<<(n))-1))
@@ -103,8 +103,8 @@ static const char * const sinfo_code = "supplementary info code";
 
 /**/
 
-static const char * const no_error = "No error";
-static const char * const unknown_error = "Unknown %s (field = %d)";
+static const char * const no_error = N_("No error");
+static const char * const unknown_error = N_("Unknown %s (field = %d)");
 
 /**/
 
@@ -116,7 +116,7 @@ display_unknown(kind, value, buffer)
 {
     char *str;
 
-    if (asprintf(&str, unknown_error, kind, value) < 0)
+    if (asprintf(&str, _(unknown_error), kind, value) < 0)
         return(0);
 
     buffer->length = strlen(str);
@@ -140,7 +140,7 @@ static OM_uint32 display_calling(minor_status, code, status_string)
             return(GSS_S_FAILURE);
         }
     } else {
-        if (! display_unknown(calling_error, GSS_CALLING_ERROR_FIELD(code),
+        if (! display_unknown(_(calling_error), GSS_CALLING_ERROR_FIELD(code),
                               status_string)) {
             *minor_status = ENOMEM;
             return(GSS_S_FAILURE);
@@ -165,7 +165,7 @@ static OM_uint32 display_routine(minor_status, code, status_string)
             return(GSS_S_FAILURE);
         }
     } else {
-        if (! display_unknown(routine_error, GSS_ROUTINE_ERROR_FIELD(code),
+        if (! display_unknown(_(routine_error), GSS_ROUTINE_ERROR_FIELD(code),
                               status_string)) {
             *minor_status = ENOMEM;
             return(GSS_S_FAILURE);
@@ -190,7 +190,7 @@ static OM_uint32 display_bit(minor_status, code, status_string)
             return(GSS_S_FAILURE);
         }
     } else {
-        if (! display_unknown(sinfo_code, 1<<code, status_string)) {
+        if (! display_unknown(_(sinfo_code), 1<<code, status_string)) {
             *minor_status = ENOMEM;
             return(GSS_S_FAILURE);
         }
diff --git a/src/lib/gssapi/krb5/acquire_cred.c b/src/lib/gssapi/krb5/acquire_cred.c
index 664f07bf6f..ca5438bc13 100644
--- a/src/lib/gssapi/krb5/acquire_cred.c
+++ b/src/lib/gssapi/krb5/acquire_cred.c
@@ -169,8 +169,9 @@ check_keytab(krb5_context context, krb5_keytab kt, krb5_gss_name_t name)
     if (code == KRB5_KT_END) {
         code = KRB5_KT_NOTFOUND;
         if (krb5_unparse_name(context, accprinc, &princname) == 0) {
-            krb5_set_error_message(context, code, "No key table entry "
-                                   "found matching %s", princname);
+            krb5_set_error_message(context, code,
+                                   _("No key table entry found matching %s"),
+                                   princname);
             free(princname);
         }
     }
diff --git a/src/lib/gssapi/mechglue/g_dsp_status.c b/src/lib/gssapi/mechglue/g_dsp_status.c
index 4357266090..13f104bea8 100644
--- a/src/lib/gssapi/mechglue/g_dsp_status.c
+++ b/src/lib/gssapi/mechglue/g_dsp_status.c
@@ -158,25 +158,25 @@ gss_buffer_t outStr;
 
 	/* take care of the success value first */
 	if (status == GSS_S_COMPLETE)
-		errStr = "The routine completed successfully";
+	    errStr = _("The routine completed successfully");
 	else if (*msgCtxt == 0 && (oneVal = GSS_CALLING_ERROR(status))) {
 		switch (oneVal) {
 		case GSS_S_CALL_INACCESSIBLE_READ:
-			errStr = "A required input parameter"
-				" could not be read";
+			errStr = _("A required input parameter could not be "
+				   "read");
 			break;
 
 		case GSS_S_CALL_INACCESSIBLE_WRITE:
-			errStr = "A required output parameter"
-				" could not be written";
+			errStr = _("A required output parameter could not be "
+				   "written");
 			break;
 
 		case GSS_S_CALL_BAD_STRUCTURE:
-			errStr = "A parameter was malformed";
+			errStr = _("A parameter was malformed");
 			break;
 
 		default:
-			errStr = "An invalid status code was supplied";
+			errStr = _("An invalid status code was supplied");
 			break;
 		}
 
@@ -192,89 +192,86 @@ gss_buffer_t outStr;
 		(oneVal = GSS_ROUTINE_ERROR(status))) {
 		switch (oneVal) {
 		case GSS_S_BAD_MECH:
-			errStr = "An unsupported mechanism"
-				" was requested";
+			errStr = _("An unsupported mechanism was requested");
 			break;
 
 		case GSS_S_BAD_NAME:
-			errStr = "An invalid name was supplied";
+			errStr = _("An invalid name was supplied");
 			break;
 
 		case GSS_S_BAD_NAMETYPE:
-			errStr = "A supplied name was of an"
-				" unsupported type";
+			errStr = _("A supplied name was of an unsupported "
+				   "type");
 			break;
 
 		case GSS_S_BAD_BINDINGS:
-			errStr = "Incorrect channel bindings"
-				" were supplied";
+			errStr = _("Incorrect channel bindings were supplied");
 			break;
 
 		case GSS_S_BAD_SIG: /* same as GSS_S_BAD_MIC: */
-			errStr = "A token had an invalid Message"
-				" Integrity Check (MIC)";
+			errStr = _("A token had an invalid Message Integrity "
+				   "Check (MIC)");
 			break;
 
 		case GSS_S_NO_CRED:
-			errStr = "No credentials were supplied, or the"
-				" credentials were unavailable or"
-				" inaccessible";
+			errStr = _("No credentials were supplied, or the "
+				   "credentials were unavailable or "
+				   "inaccessible");
 			break;
 
 		case GSS_S_NO_CONTEXT:
-			errStr = "No context has been established";
+			errStr = _("No context has been established");
 			break;
 
 		case GSS_S_DEFECTIVE_TOKEN:
-			errStr = "Invalid token was supplied";
+			errStr = _("Invalid token was supplied");
 			break;
 
 		case GSS_S_DEFECTIVE_CREDENTIAL:
-			errStr = "Invalid credential was supplied";
+			errStr = _("Invalid credential was supplied");
 			break;
 
 		case GSS_S_CREDENTIALS_EXPIRED:
-			errStr = "The referenced credential has"
-				" expired";
+			errStr = _("The referenced credential has expired");
 			break;
 
 		case GSS_S_CONTEXT_EXPIRED:
-			errStr = "The referenced context has expired";
+			errStr = _("The referenced context has expired");
 			break;
 
 		case GSS_S_FAILURE:
-			errStr = "Unspecified GSS failure.  Minor code"
-				" may provide more information";
+			errStr = _("Unspecified GSS failure.  Minor code "
+				   "may provide more information");
 			break;
 
 		case GSS_S_BAD_QOP:
-			errStr = "The quality-of-protection (QOP) "
-				"requested could not be provided";
+			errStr = _("The quality-of-protection (QOP) "
+				   "requested could not be provided");
 			break;
 
 		case GSS_S_UNAUTHORIZED:
-			errStr = "The operation is forbidden by local"
-				" security policy";
+			errStr = _("The operation is forbidden by local "
+				   " security policy");
 			break;
 
 		case GSS_S_UNAVAILABLE:
-			errStr = "The operation or option is not"
-				" available or unsupported";
+			errStr = _("The operation or option is not "
+				   "available or unsupported");
 			break;
 
 		case GSS_S_DUPLICATE_ELEMENT:
-			errStr = "The requested credential element"
-				" already exists";
+			errStr = _("The requested credential element "
+				   "already exists");
 			break;
 
 		case GSS_S_NAME_NOT_MN:
-			errStr = "The provided name was not mechanism"
-				" specific (MN)";
+			errStr = _("The provided name was not mechanism "
+				   "specific (MN)");
 			break;
 
 		case GSS_S_BAD_STATUS:
 		default:
-			errStr = "An invalid status code was supplied";
+			errStr = _("An invalid status code was supplied");
 		}
 
 		/* we must determine if the caller should call us again */
@@ -311,32 +308,30 @@ gss_buffer_t outStr;
 
 		switch (currErr) {
 		case GSS_S_CONTINUE_NEEDED:
-			errStr = "The routine must be called again to"
-				" complete its function";
+			errStr = _("The routine must be called again to "
+				   "complete its function");
 			break;
 
 		case GSS_S_DUPLICATE_TOKEN:
-			errStr = "The token was a duplicate of an"
-				" earlier token";
+			errStr = _("The token was a duplicate of an earlier "
+				   "token");
 			break;
 
 		case GSS_S_OLD_TOKEN:
-			errStr = "The token's validity period"
-				" has expired";
+			errStr = _("The token's validity period has expired");
 			break;
 
 		case GSS_S_UNSEQ_TOKEN:
-			errStr = "A later token has already been"
-				" processed";
+			errStr = _("A later token has already been processed");
 			break;
 
 		case GSS_S_GAP_TOKEN:
-			errStr = "An expected per-message token was"
-				" not received";
+			errStr = _("An expected per-message token was not "
+				   "received");
 			break;
 
 		default:
-			errStr = "An invalid status code was supplied";
+			errStr = _("An invalid status code was supplied");
 		}
 
 		/*
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 3467ee0d79..3beb93ec40 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1792,23 +1792,28 @@ spnego_gss_display_status(
 	switch (status_value) {
 	    case ERR_SPNEGO_NO_MECHS_AVAILABLE:
 		/* CSTYLED */
-		*status_string = make_err_msg("SPNEGO cannot find mechanisms to negotiate");
+		*status_string = make_err_msg(_("SPNEGO cannot find "
+						"mechanisms to negotiate"));
 		break;
 	    case ERR_SPNEGO_NO_CREDS_ACQUIRED:
 		/* CSTYLED */
-		*status_string = make_err_msg("SPNEGO failed to acquire creds");
+		*status_string = make_err_msg(_("SPNEGO failed to acquire "
+						"creds"));
 		break;
 	    case ERR_SPNEGO_NO_MECH_FROM_ACCEPTOR:
 		/* CSTYLED */
-		*status_string = make_err_msg("SPNEGO acceptor did not select a mechanism");
+		*status_string = make_err_msg(_("SPNEGO acceptor did not "
+						"select a mechanism"));
 		break;
 	    case ERR_SPNEGO_NEGOTIATION_FAILED:
 		/* CSTYLED */
-		*status_string = make_err_msg("SPNEGO failed to negotiate a mechanism");
+		*status_string = make_err_msg(_("SPNEGO failed to negotiate a "
+						"mechanism"));
 		break;
 	    case ERR_SPNEGO_NO_TOKEN_FROM_ACCEPTOR:
 		/* CSTYLED */
-		*status_string = make_err_msg("SPNEGO acceptor did not return a valid token");
+		*status_string = make_err_msg(_("SPNEGO acceptor did not "
+						"return a valid token"));
 		break;
 	    default:
 		status_string->length = 0;
diff --git a/src/lib/kadm5/alt_prof.c b/src/lib/kadm5/alt_prof.c
index f6ee1c2f80..98231ab330 100644
--- a/src/lib/kadm5/alt_prof.c
+++ b/src/lib/kadm5/alt_prof.c
@@ -902,9 +902,9 @@ kadm5_get_admin_service_name(krb5_context ctx,
     if (err != 0) {
         ret = KADM5_CANT_RESOLVE;
         krb5_set_error_message(ctx, ret,
-                               "Cannot resolve address of admin server \"%s\" "
-                               "for realm \"%s\"", params_out.admin_server,
-                               realm_in);
+                               _("Cannot resolve address of admin server "
+                                 "\"%s\" for realm \"%s\""),
+                               params_out.admin_server, realm_in);
         goto err_params;
     }
     if (strlen(ai->ai_canonname) + sizeof("kadmin/") > maxlen) {
diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
index e45f6b1552..9b99635fac 100644
--- a/src/lib/kadm5/logger.c
+++ b/src/lib/kadm5/logger.c
@@ -53,19 +53,19 @@
 #define LOG_ERR         0
 #endif  /* LOG_ERR */
 
-#define lspec_parse_err_1       "%s: cannot parse <%s>\n"
-#define lspec_parse_err_2       "%s: warning - logging entry syntax error\n"
-#define log_file_err            "%s: error writing to %s\n"
-#define log_device_err          "%s: error writing to %s device\n"
+#define lspec_parse_err_1       _("%s: cannot parse <%s>\n")
+#define lspec_parse_err_2       _("%s: warning - logging entry syntax error\n")
+#define log_file_err            _("%s: error writing to %s\n")
+#define log_device_err          _("%s: error writing to %s device\n")
 #define log_ufo_string          "?\?\?" /* nb: avoid trigraphs */
-#define log_emerg_string        "EMERGENCY"
-#define log_alert_string        "ALERT"
-#define log_crit_string         "CRITICAL"
-#define log_err_string          "Error"
-#define log_warning_string      "Warning"
-#define log_notice_string       "Notice"
-#define log_info_string         "info"
-#define log_debug_string        "debug"
+#define log_emerg_string        _("EMERGENCY")
+#define log_alert_string        _("ALERT")
+#define log_crit_string         _("CRITICAL")
+#define log_err_string          _("Error")
+#define log_warning_string      _("Warning")
+#define log_notice_string       _("Notice")
+#define log_info_string         _("info")
+#define log_debug_string        _("debug")
 
 /*
  * Output logging.
@@ -964,7 +964,7 @@ krb5_klog_reopen(krb5_context kcontext)
                 set_cloexec_file(f);
                 log_control.log_entries[lindex].lfu_filep = f;
             } else {
-                fprintf(stderr, "Couldn't open log file %s: %s\n",
+                fprintf(stderr, _("Couldn't open log file %s: %s\n"),
                         log_control.log_entries[lindex].lfu_fname,
                         error_message(errno));
             }
diff --git a/src/lib/kadm5/srv/kadm5_hook.c b/src/lib/kadm5/srv/kadm5_hook.c
index c9a630ea91..68a6b5eb44 100644
--- a/src/lib/kadm5/srv/kadm5_hook.c
+++ b/src/lib/kadm5/srv/kadm5_hook.c
@@ -116,7 +116,7 @@ log_failure(krb5_context context,
 {
     const char *e = krb5_get_error_message(context, ret);
 
-    krb5_klog_syslog(LOG_ERR, "kadm5_hook %s failed postcommit %s: %s",
+    krb5_klog_syslog(LOG_ERR, _("kadm5_hook %s failed postcommit %s: %s"),
                      name, function, e);
     krb5_free_error_message(context, e);
 }
diff --git a/src/lib/kadm5/srv/pwqual_dict.c b/src/lib/kadm5/srv/pwqual_dict.c
index 778b177b5e..f736eacf4a 100644
--- a/src/lib/kadm5/srv/pwqual_dict.c
+++ b/src/lib/kadm5/srv/pwqual_dict.c
@@ -102,15 +102,16 @@ init_dict(dict_moddata dict, const char *dict_file)
     struct stat sb;
 
     if (dict_file == NULL) {
-        krb5_klog_syslog(LOG_INFO, "No dictionary file specified, continuing "
-                         "without one.");
+        krb5_klog_syslog(LOG_INFO,
+                         _("No dictionary file specified, continuing without "
+                           "one."));
         return KADM5_OK;
     }
     if ((fd = open(dict_file, O_RDONLY)) == -1) {
         if (errno == ENOENT) {
             krb5_klog_syslog(LOG_ERR,
-                             "WARNING!  Cannot find dictionary file %s, "
-                             "continuing without one.", dict_file);
+                             _("WARNING!  Cannot find dictionary file %s, "
+                               "continuing without one."), dict_file);
             return KADM5_OK;
         } else
             return errno;
diff --git a/src/lib/kadm5/srv/pwqual_empty.c b/src/lib/kadm5/srv/pwqual_empty.c
index 8c26a13c32..67118db019 100644
--- a/src/lib/kadm5/srv/pwqual_empty.c
+++ b/src/lib/kadm5/srv/pwqual_empty.c
@@ -39,7 +39,7 @@ empty_check(krb5_context context, krb5_pwqual_moddata data,
      * with no password policy. */
     if (*password == '\0') {
         krb5_set_error_message(context, KADM5_PASS_Q_TOOSHORT,
-                               "Empty passwords are not allowed");
+                               _("Empty passwords are not allowed"));
         return KADM5_PASS_Q_TOOSHORT;
     }
     return 0;
diff --git a/src/lib/kadm5/srv/pwqual_hesiod.c b/src/lib/kadm5/srv/pwqual_hesiod.c
index 43f4f84b8f..28959d76ed 100644
--- a/src/lib/kadm5/srv/pwqual_hesiod.c
+++ b/src/lib/kadm5/srv/pwqual_hesiod.c
@@ -111,7 +111,8 @@ hesiod_check(krb5_context context, krb5_pwqual_moddata data,
         ent = hes_getpwnam(cp);
         if (ent && ent->pw_gecos && str_check_gecos(ent->pw_gecos, password)) {
             krb5_set_error_message(context, KADM5_PASS_Q_DICT,
-                                   "Password maynot match user information.");
+                                   _("Password may not match user "
+                                     "information."));
             return KADM5_PASS_Q_DICT;
         }
     }
diff --git a/src/lib/kadm5/srv/pwqual_princ.c b/src/lib/kadm5/srv/pwqual_princ.c
index ff16ccf758..f733a393f9 100644
--- a/src/lib/kadm5/srv/pwqual_princ.c
+++ b/src/lib/kadm5/srv/pwqual_princ.c
@@ -51,7 +51,7 @@ princ_check(krb5_context context, krb5_pwqual_moddata data,
         cp = krb5_princ_component(handle->context, princ, i)->data;
         if (strcasecmp(cp, password) == 0) {
             krb5_set_error_message(context, KADM5_PASS_Q_DICT,
-                                   "Password may not match principal name");
+                                   _("Password may not match principal name"));
             return KADM5_PASS_Q_DICT;
         }
     }
diff --git a/src/lib/kadm5/srv/server_acl.c b/src/lib/kadm5/srv/server_acl.c
index 0ca30f44db..17d4992700 100644
--- a/src/lib/kadm5/srv/server_acl.c
+++ b/src/lib/kadm5/srv/server_acl.c
@@ -87,10 +87,12 @@ static int acl_debug_level = 0;
  */
 static const char *acl_catchall_entry = NULL;
 
-static const char *acl_line2long_msg = "%s: line %d too long, truncated";
-static const char *acl_op_bad_msg = "Unrecognized ACL operation '%c' in %s";
-static const char *acl_syn_err_msg = "%s: syntax error at line %d <%10s...>";
-static const char *acl_cantopen_msg = "%s while opening ACL file %s";
+static const char *acl_line2long_msg = N_("%s: line %d too long, truncated");
+static const char *acl_op_bad_msg = N_("Unrecognized ACL operation '%c' in "
+                                       "%s");
+static const char *acl_syn_err_msg = N_("%s: syntax error at line %d "
+                                        "<%10s...>");
+static const char *acl_cantopen_msg = N_("%s while opening ACL file %s");
 
 
 /*
@@ -132,7 +134,8 @@ kadm5int_acl_get_line(fp, lnp)
         if (i == sizeof acl_buf && (i--, !feof(fp))) {
             int c1 = acl_buf[i], c2;
 
-            krb5_klog_syslog(LOG_ERR, acl_line2long_msg, acl_acl_file, *lnp);
+            krb5_klog_syslog(LOG_ERR, _(acl_line2long_msg), acl_acl_file,
+                             *lnp);
             while ((c2 = fgetc(fp)) != EOF) {
                 if (c2 == '\n') {
                     if (c1 != '\\')
@@ -208,7 +211,7 @@ kadm5int_acl_parse_line(lp)
                     }
                 }
                 if (!found) {
-                    krb5_klog_syslog(LOG_ERR, acl_op_bad_msg, *op, lp);
+                    krb5_klog_syslog(LOG_ERR, _(acl_op_bad_msg), *op, lp);
                     opok = 0;
                 }
             }
@@ -497,7 +500,7 @@ kadm5int_acl_load_acl_file()
             *aentpp = kadm5int_acl_parse_line(alinep);
             /* If syntax error, then fall out */
             if (!*aentpp) {
-                krb5_klog_syslog(LOG_ERR, acl_syn_err_msg,
+                krb5_klog_syslog(LOG_ERR, _(acl_syn_err_msg),
                                  acl_acl_file, alineno, alinep);
                 retval = 0;
                 break;
@@ -522,7 +525,7 @@ kadm5int_acl_load_acl_file()
         }
     }
     else {
-        krb5_klog_syslog(LOG_ERR, acl_cantopen_msg,
+        krb5_klog_syslog(LOG_ERR, _(acl_cantopen_msg),
                          error_message(errno), acl_acl_file);
         if (acl_catchall_entry &&
             (acl_list_head = kadm5int_acl_parse_line(acl_catchall_entry))) {
diff --git a/src/lib/kadm5/srv/server_kdb.c b/src/lib/kadm5/srv/server_kdb.c
index deb718149e..e8a78103cf 100644
--- a/src/lib/kadm5/srv/server_kdb.c
+++ b/src/lib/kadm5/srv/server_kdb.c
@@ -192,7 +192,7 @@ kdb_get_hist_key(kadm5_server_handle_t handle, krb5_keyblock *hist_keyblock,
     if (kdb->n_key_data <= 0) {
         ret = KRB5_KDB_NO_MATCHING_KEY;
         krb5_set_error_message(handle->context, ret,
-                               "History entry contains no key data");
+                               _("History entry contains no key data"));
         goto done;
     }
 
diff --git a/src/lib/kadm5/srv/server_misc.c b/src/lib/kadm5/srv/server_misc.c
index 907a3c5c9a..30a0b5abda 100644
--- a/src/lib/kadm5/srv/server_misc.c
+++ b/src/lib/kadm5/srv/server_misc.c
@@ -142,8 +142,9 @@ passwd_check(kadm5_server_handle_t handle, const char *password,
             char *princname;
             if (krb5_unparse_name(handle->context, princ, &princname) != 0)
                 princname = NULL;
-            krb5_klog_syslog(LOG_ERR, "password quality module %s rejected "
-                             "password for %s: %s", modname,
+            krb5_klog_syslog(LOG_ERR,
+                             _("password quality module %s rejected password "
+                               "for %s: %s"), modname,
                              princname ? princname : "(can't unparse)", e);
             krb5_free_error_message(handle->context, e);
             free(princname);
diff --git a/src/lib/kadm5/str_conv.c b/src/lib/kadm5/str_conv.c
index 5151d18190..b36af1e246 100644
--- a/src/lib/kadm5/str_conv.c
+++ b/src/lib/kadm5/str_conv.c
@@ -77,22 +77,22 @@ static const char flags_pwsvc_in[]      = "pwservice";
 static const char flags_md5_in[]        = "md5";
 static const char flags_ok_to_auth_as_delegate_in[] = "ok-to-auth-as-delegate";
 static const char flags_no_auth_data_required_in[] = "no-auth-data-required";
-static const char flags_pdate_out[]     = "Not Postdateable";
-static const char flags_fwd_out[]       = "Not Forwardable";
-static const char flags_tgtbased_out[]  = "No TGT-based requests";
-static const char flags_renew_out[]     = "Not renewable";
-static const char flags_proxy_out[]     = "Not proxiable";
-static const char flags_dup_skey_out[]  = "No DUP_SKEY requests";
-static const char flags_tickets_out[]   = "All Tickets Disallowed";
-static const char flags_preauth_out[]   = "Preauthentication required";
-static const char flags_hwauth_out[]    = "HW authentication required";
-static const char flags_ok_as_delegate_out[]    = "OK as Delegate";
-static const char flags_pwchange_out[]  = "Password Change required";
-static const char flags_service_out[]   = "Service Disabled";
-static const char flags_pwsvc_out[]     = "Password Changing Service";
-static const char flags_md5_out[]       = "RSA-MD5 supported";
-static const char flags_ok_to_auth_as_delegate_out[] = "Protocol transition with delegation allowed";
-static const char flags_no_auth_data_required_out[] = "No authorization data required";
+static const char flags_pdate_out[]     = N_("Not Postdateable");
+static const char flags_fwd_out[]       = N_("Not Forwardable");
+static const char flags_tgtbased_out[]  = N_("No TGT-based requests");
+static const char flags_renew_out[]     = N_("Not renewable");
+static const char flags_proxy_out[]     = N_("Not proxiable");
+static const char flags_dup_skey_out[]  = N_("No DUP_SKEY requests");
+static const char flags_tickets_out[]   = N_("All Tickets Disallowed");
+static const char flags_preauth_out[]   = N_("Preauthentication required");
+static const char flags_hwauth_out[]    = N_("HW authentication required");
+static const char flags_ok_as_delegate_out[]    = N_("OK as Delegate");
+static const char flags_pwchange_out[]  = N_("Password Change required");
+static const char flags_service_out[]   = N_("Service Disabled");
+static const char flags_pwsvc_out[]     = N_("Password Changing Service");
+static const char flags_md5_out[]       = N_("RSA-MD5 supported");
+static const char flags_ok_to_auth_as_delegate_out[] = N_("Protocol transition with delegation allowed");
+static const char flags_no_auth_data_required_out[] = N_("No authorization data required");
 static const char flags_default_neg[]   = "-";
 static const char flags_default_sep[]   = " ";
 
@@ -189,7 +189,7 @@ krb5_flags_to_string(flags, sep, buffer, buflen)
         if (flags & flags_table[i].fl_flags) {
             if (krb5int_buf_len(&buf) > 0)
                 krb5int_buf_add(&buf, sepstring);
-            krb5int_buf_add(&buf, flags_table[i].fl_output);
+            krb5int_buf_add(&buf, _(flags_table[i].fl_output));
             /* Keep track of what we matched */
             pflags |= flags_table[i].fl_flags;
         }
diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
index b37a5c1102..e18b99e8b2 100644
--- a/src/lib/kdb/kdb5.c
+++ b/src/lib/kdb/kdb5.c
@@ -180,7 +180,8 @@ get_conf_section(krb5_context context, char **section)
 
     if (context->default_realm == NULL) {
         krb5_set_error_message(context, KRB5_KDB_SERVER_INTERNAL_ERR,
-                               "No default realm set; cannot initialize KDB");
+                               _("No default realm set; cannot initialize "
+                                 "KDB"));
         return KRB5_KDB_SERVER_INTERNAL_ERR;
     }
     status = profile_get_string(context->profile,
@@ -282,7 +283,7 @@ kdb_load_library(krb5_context kcontext, char *lib_name, db_library *libptr)
 #endif
     if (!vftabl_addr) {
         krb5_set_error_message(kcontext, KRB5_KDB_DBTYPE_NOTFOUND,
-                               "Unable to find requested database type: %s",
+                               _("Unable to find requested database type: %s"),
                                lib_name);
         return KRB5_PLUGIN_OP_NOTSUPP;
     }
@@ -364,9 +365,10 @@ kdb_load_library(krb5_context kcontext, char *lib_name, db_library *lib)
                                             &(*lib)->dl_dir_handle, &kcontext->err))) {
         const char *err_str = krb5_get_error_message(kcontext, status);
         status = KRB5_KDB_DBTYPE_NOTFOUND;
-        krb5_set_error_message (kcontext, status,
-                                "Unable to find requested database type: %s", err_str);
-        krb5_free_error_message (kcontext, err_str);
+        krb5_set_error_message(kcontext, status,
+                               _("Unable to find requested database type: %s"),
+                               err_str);
+        krb5_free_error_message(kcontext, err_str);
         goto clean_n_exit;
     }
 
@@ -374,18 +376,20 @@ kdb_load_library(krb5_context kcontext, char *lib_name, db_library *lib)
                                                &vftabl_addrs, &kcontext->err))) {
         const char *err_str = krb5_get_error_message(kcontext, status);
         status = KRB5_KDB_DBTYPE_INIT;
-        krb5_set_error_message (kcontext, status,
-                                "plugin symbol 'kdb_function_table' lookup failed: %s", err_str);
-        krb5_free_error_message (kcontext, err_str);
+        krb5_set_error_message(kcontext, status,
+                               _("plugin symbol 'kdb_function_table' lookup "
+                                 "failed: %s"), err_str);
+        krb5_free_error_message(kcontext, err_str);
         goto clean_n_exit;
     }
 
     if (vftabl_addrs[0] == NULL) {
         /* No plugins! */
         status = KRB5_KDB_DBTYPE_NOTFOUND;
-        krb5_set_error_message (kcontext, status,
-                                _("Unable to load requested database module '%s': plugin symbol 'kdb_function_table' not found"),
-                                lib_name);
+        krb5_set_error_message(kcontext, status,
+                               _("Unable to load requested database module "
+                                 "'%s': plugin symbol 'kdb_function_table' "
+                                 "not found"), lib_name);
         goto clean_n_exit;
     }
 
@@ -1709,8 +1713,8 @@ krb5_dbe_lookup_mkey_aux(krb5_context context, krb5_db_entry *entry,
             }
         } else {
             krb5_set_error_message(context, KRB5_KDB_BAD_VERSION,
-                                   "Illegal version number for KRB5_TL_MKEY_AUX %d\n",
-                                   version);
+                                   _("Illegal version number for "
+                                     "KRB5_TL_MKEY_AUX %d\n"), version);
             return (KRB5_KDB_BAD_VERSION);
         }
     }
@@ -1860,9 +1864,9 @@ krb5_dbe_lookup_actkvno(krb5_context context, krb5_db_entry *entry,
                 next_tuple += ACTKVNO_TUPLE_SIZE;
             }
         } else {
-            krb5_set_error_message (context, KRB5_KDB_BAD_VERSION,
-                                    "Illegal version number for KRB5_TL_ACTKVNO %d\n",
-                                    version);
+            krb5_set_error_message(context, KRB5_KDB_BAD_VERSION,
+                                   _("Illegal version number for "
+                                     "KRB5_TL_ACTKVNO %d\n"), version);
             return (KRB5_KDB_BAD_VERSION);
         }
     }
diff --git a/src/lib/kdb/kdb_default.c b/src/lib/kdb/kdb_default.c
index 9763d6e80b..d8dd4266e7 100644
--- a/src/lib/kdb/kdb_default.c
+++ b/src/lib/kdb/kdb_default.c
@@ -160,9 +160,9 @@ krb5_def_store_mkey_list(krb5_context       context,
         /* if keyfile exists it better be a regular file */
         if (!S_ISREG(stb.st_mode)) {
             retval = EINVAL;
-            krb5_set_error_message (context, retval,
-                                    "keyfile (%s) is not a regular file: %s",
-                                    keyfile, error_message(retval));
+            krb5_set_error_message(context, retval,
+                                   _("keyfile (%s) is not a regular file: %s"),
+                                   keyfile, error_message(retval));
             goto out;
         }
     }
@@ -171,8 +171,8 @@ krb5_def_store_mkey_list(krb5_context       context,
 
     /* create temp file template for use by mktemp() */
     if ((retval = asprintf(&tmp_ktname, "WRFILE:%s_XXXXXX", keyfile)) < 0) {
-        krb5_set_error_message (context, retval,
-                                "Could not create temp keytab file name.");
+        krb5_set_error_message(context, retval,
+                               _("Could not create temp keytab file name."));
         goto out;
     }
 
@@ -185,9 +185,9 @@ krb5_def_store_mkey_list(krb5_context       context,
 
     if (mktemp(tmp_ktpath) == NULL) {
         retval = errno;
-        krb5_set_error_message (context, retval,
-                                "Could not create temp stash file: %s",
-                                error_message(errno));
+        krb5_set_error_message(context, retval,
+                               _("Could not create temp stash file: %s"),
+                               error_message(errno));
         goto out;
     }
 
@@ -215,9 +215,10 @@ krb5_def_store_mkey_list(krb5_context       context,
         /* rename original keyfile to original filename */
         if (rename(tmp_ktpath, keyfile) < 0) {
             retval = errno;
-            krb5_set_error_message (context, retval,
-                                    "rename of temporary keyfile (%s) to (%s) failed: %s",
-                                    tmp_ktpath, keyfile, error_message(errno));
+            krb5_set_error_message(context, retval,
+                                   _("rename of temporary keyfile (%s) to "
+                                     "(%s) failed: %s"), tmp_ktpath, keyfile,
+                                   error_message(errno));
         }
     }
 
@@ -405,7 +406,7 @@ krb5_db_def_fetch_mkey(krb5_context   context,
      */
     if (retval != 0) {
         krb5_set_error_message(context, KRB5_KDB_CANTREAD_STORED,
-                               "Can not fetch master key (error: %s).",
+                               _("Can not fetch master key (error: %s)."),
                                error_message(retval));
         return KRB5_KDB_CANTREAD_STORED;
     } else
@@ -468,8 +469,9 @@ krb5_def_fetch_mkey_list(krb5_context        context,
             }
         }
         if (found_key != TRUE) {
-            krb5_set_error_message (context, KRB5_KDB_BADMASTERKEY,
-                                    "Unable to decrypt latest master key with the provided master key\n");
+            krb5_set_error_message(context, KRB5_KDB_BADMASTERKEY,
+                                   _("Unable to decrypt latest master key "
+                                     "with the provided master key\n"));
             retval = KRB5_KDB_BADMASTERKEY;
             goto clean_n_exit;
         }
diff --git a/src/lib/kdb/kdb_log.c b/src/lib/kdb/kdb_log.c
index c254ab27d7..625c71a3ee 100644
--- a/src/lib/kdb/kdb_log.c
+++ b/src/lib/kdb/kdb_log.c
@@ -100,7 +100,7 @@ ulog_sync_header(kdb_hlog_t *ulog)
         /*
          * Couldn't sync to disk, let's panic
          */
-        syslog(LOG_ERR, "ulog_sync_header: could not sync to disk");
+        syslog(LOG_ERR, _("ulog_sync_header: could not sync to disk"));
         abort();
     }
 }
diff --git a/src/lib/krb5/ccache/cc_file.c b/src/lib/krb5/ccache/cc_file.c
index 117cdd5466..131ccb533d 100644
--- a/src/lib/krb5/ccache/cc_file.c
+++ b/src/lib/krb5/ccache/cc_file.c
@@ -1240,7 +1240,7 @@ krb5_fcc_open_file (krb5_context context, krb5_ccache id, int mode)
         case ENOENT:
             retval = KRB5_FCC_NOFILE;
             krb5_set_error_message(context, retval,
-                                   "Credentials cache file '%s' not found",
+                                   _("Credentials cache file '%s' not found"),
                                    data->filename);
             return retval;
         default:
@@ -2517,8 +2517,8 @@ krb5_fcc_interpret(krb5_context context, int errnum)
     default:
         retval = KRB5_CC_IO;            /* XXX */
         krb5_set_error_message(context, retval,
-                               "Credentials cache I/O operation failed (%s)",
-                               strerror(errnum));
+                               _("Credentials cache I/O operation failed "
+                                 "(%s)"), strerror(errnum));
     }
     return retval;
 }
diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
index f2e26db8b2..d2aa88bee1 100644
--- a/src/lib/krb5/keytab/kt_file.c
+++ b/src/lib/krb5/keytab/kt_file.c
@@ -395,8 +395,9 @@ krb5_ktfile_get_entry(krb5_context context, krb5_keytab id,
         else {
             kerror = KRB5_KT_NOTFOUND;
             if (krb5_unparse_name(context, principal, &princname) == 0) {
-                krb5_set_error_message(context, kerror, "No key table entry "
-                                       "found for %s", princname);
+                krb5_set_error_message(context, kerror,
+                                       _("No key table entry found for %s"),
+                                       princname);
                 free(princname);
             }
         }
@@ -822,7 +823,8 @@ krb5_ktfile_add(krb5_context context, krb5_keytab id, krb5_keytab_entry *entry)
         /* Iterator(s) active -- no changes.  */
         KTUNLOCK(id);
         krb5_set_error_message(context, KRB5_KT_IOERR,
-                               "Cannot change keytab with keytab iterators active");
+                               _("Cannot change keytab with keytab iterators "
+                                 "active"));
         return KRB5_KT_IOERR;   /* XXX */
     }
     if ((retval = krb5_ktfileint_openw(context, id))) {
@@ -857,7 +859,8 @@ krb5_ktfile_remove(krb5_context context, krb5_keytab id, krb5_keytab_entry *entr
         /* Iterator(s) active -- no changes.  */
         KTUNLOCK(id);
         krb5_set_error_message(context, KRB5_KT_IOERR,
-                               "Cannot change keytab with keytab iterators active");
+                               _("Cannot change keytab with keytab iterators "
+                                 "active"));
         return KRB5_KT_IOERR;   /* XXX */
     }
 
@@ -1056,7 +1059,7 @@ krb5_ktfileint_open(krb5_context context, krb5_keytab id, int mode)
                 return EMFILE;
             case ENOENT:
                 krb5_set_error_message(context, ENOENT,
-                                       "Key table file '%s' not found",
+                                       _("Key table file '%s' not found"),
                                        KTFILENAME(id));
                 return ENOENT;
             default:
diff --git a/src/lib/krb5/krb/chpw.c b/src/lib/krb5/krb/chpw.c
index 305808bd61..7e43dcf1a1 100644
--- a/src/lib/krb5/krb/chpw.c
+++ b/src/lib/krb5/krb/chpw.c
@@ -248,28 +248,28 @@ krb5_chpw_result_code_string(krb5_context context, int result_code,
 {
     switch (result_code) {
     case KRB5_KPASSWD_MALFORMED:
-        *code_string = "Malformed request error";
+        *code_string = _("Malformed request error");
         break;
     case KRB5_KPASSWD_HARDERROR:
-        *code_string = "Server error";
+        *code_string = _("Server error");
         break;
     case KRB5_KPASSWD_AUTHERROR:
-        *code_string = "Authentication error";
+        *code_string = _("Authentication error");
         break;
     case KRB5_KPASSWD_SOFTERROR:
-        *code_string = "Password change rejected";
+        *code_string = _("Password change rejected");
         break;
     case KRB5_KPASSWD_ACCESSDENIED:
-        *code_string = "Access denied";
+        *code_string = _("Access denied");
         break;
     case KRB5_KPASSWD_BAD_VERSION:
-        *code_string = "Wrong protocol version";
+        *code_string = _("Wrong protocol version");
         break;
     case KRB5_KPASSWD_INITIAL_FLAG_NEEDED:
-        *code_string = "Initial password required";
+        *code_string = _("Initial password required");
         break;
     default:
-        *code_string = "Password change failed";
+        *code_string = _("Password change failed");
         break;
     }
 
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 3939f0e4ae..0d04cc2b02 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -179,7 +179,7 @@ krb5int_fast_as_armor(krb5_context context,
             const char * errmsg;
             errmsg = krb5_get_error_message(context, retval);
             krb5_set_error_message(context, retval,
-                                   "%s constructing AP-REQ armor", errmsg);
+                                   _("%s constructing AP-REQ armor"), errmsg);
             krb5_free_error_message(context, errmsg);
         }
     }
@@ -319,7 +319,7 @@ decrypt_fast_reply(krb5_context context,
         const char * errmsg;
         errmsg = krb5_get_error_message(context, retval);
         krb5_set_error_message(context, retval,
-                               "%s while decrypting FAST reply", errmsg);
+                               _("%s while decrypting FAST reply"), errmsg);
         krb5_free_error_message(context, errmsg);
     }
     if (retval == 0)
@@ -327,8 +327,9 @@ decrypt_fast_reply(krb5_context context,
     if (retval == 0) {
         if (local_resp->nonce != state->nonce) {
             retval = KRB5_KDCREP_MODIFIED;
-            krb5_set_error_message(context, retval, "nonce modified in FAST "
-                                   "response: KDC response modified");
+            krb5_set_error_message(context, retval,
+                                   _("nonce modified in FAST response: "
+                                     "KDC response modified"));
         }
     }
     if (retval == 0) {
@@ -397,8 +398,8 @@ krb5int_fast_process_error(krb5_context context,
                                                KRB5_PADATA_FX_ERROR);
             if (fx_error_pa == NULL) {
                 krb5_set_error_message(context, KRB5KDC_ERR_PREAUTH_FAILED,
-                                       "Expecting FX_ERROR pa-data inside "
-                                       "FAST container");
+                                       _("Expecting FX_ERROR pa-data inside "
+                                         "FAST container"));
                 retval = KRB5KDC_ERR_PREAUTH_FAILED;
             }
         }
@@ -451,7 +452,7 @@ krb5int_fast_process_error(krb5_context context,
             }
             krb5_free_pa_data(context, result);
             krb5_set_error_message(context, retval,
-                                   "Error decoding padata in error reply");
+                                   _("Error decoding padata in error reply"));
             return retval;
         }
     }
@@ -479,8 +480,9 @@ krb5int_fast_process_response(krb5_context context,
     if (retval == 0) {
         if (fast_response->finished == 0) {
             retval = KRB5_KDCREP_MODIFIED;
-            krb5_set_error_message(context, retval, "FAST response missing "
-                                   "finish message in KDC reply");
+            krb5_set_error_message(context, retval,
+                                   _("FAST response missing finish message "
+                                     "in KDC reply"));
         }
     }
     if (retval == 0)
@@ -494,7 +496,7 @@ krb5int_fast_process_response(krb5_context context,
     if (retval == 0 && cksum_valid == 0) {
         retval = KRB5_KDCREP_MODIFIED;
         krb5_set_error_message(context, retval,
-                               "ticket modified in KDC reply");
+                               _("Ticket modified in KDC reply"));
     }
     if (retval == 0) {
         krb5_free_principal(context, resp->client);
diff --git a/src/lib/krb5/krb/gc_via_tkt.c b/src/lib/krb5/krb/gc_via_tkt.c
index 525de0c09b..e25860cb66 100644
--- a/src/lib/krb5/krb/gc_via_tkt.c
+++ b/src/lib/krb5/krb/gc_via_tkt.c
@@ -262,7 +262,7 @@ krb5int_process_tgs_reply(krb5_context context,
             switch (err_reply->error) {
             case KRB_ERR_GENERIC:
                 krb5_set_error_message(context, retval,
-                                       "KDC returned error string: %.*s",
+                                       _("KDC returned error string: %.*s"),
                                        err_reply->text.length,
                                        err_reply->text.data);
                 break;
@@ -272,8 +272,8 @@ krb5int_process_tgs_reply(krb5_context context,
                 if (err_reply->server &&
                     krb5_unparse_name(context, err_reply->server, &s_name) == 0) {
                     krb5_set_error_message(context, retval,
-                                           "Server %s not found in Kerberos database",
-                                           s_name);
+                                           _("Server %s not found in Kerberos "
+                                             "database"), s_name);
                     krb5_free_unparsed_name(context, s_name);
                 } else
                     /* In case there's a stale S_PRINCIPAL_UNKNOWN
diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index b87eb07b7e..fc00e21d7b 100644
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -140,8 +140,8 @@ cleanup:
     return ret;
 verification_error:
     ret = KRB5_KDCREP_MODIFIED;
-    krb5_set_error_message(context, ret, "Reply has wrong form of session key "
-                           "for anonymous request");
+    krb5_set_error_message(context, ret, _("Reply has wrong form of session "
+                                           "key for anonymous request"));
     goto cleanup;
 }
 
@@ -1481,7 +1481,7 @@ init_creds_step_reply(krb5_context context,
             const char *msg;
             msg = krb5_get_error_message(context, code);
             krb5_set_error_message(context, code,
-                                   "%s while storing credentials", msg);
+                                   _("%s while storing credentials"), msg);
             krb5_free_error_message(context, msg);
         }
     }
@@ -1570,8 +1570,8 @@ cleanup:
         code2 = krb5_unparse_name(context, ctx->request->client, &client_name);
         if (code2 == 0) {
             krb5_set_error_message(context, code,
-                                   "Client '%s' not found in Kerberos database",
-                                   client_name);
+                                   _("Client '%s' not found in Kerberos "
+                                     "database"), client_name);
             krb5_free_unparsed_name(context, client_name);
         }
     }
diff --git a/src/lib/krb5/krb/gic_opt.c b/src/lib/krb5/krb/gic_opt.c
index 062659b9bf..acb6f126dc 100644
--- a/src/lib/krb5/krb/gic_opt.c
+++ b/src/lib/krb5/krb/gic_opt.c
@@ -288,8 +288,8 @@ krb5int_gic_opt_to_opte(krb5_context context,
             return gic_opte_copy(context, opt, opte);
         } else {
             krb5int_set_error(&context->err, EINVAL,
-                              "%s: attempt to convert non-extended krb5_get_init_creds_opt",
-                              where);
+                              _("%s: attempt to convert non-extended "
+                                "krb5_get_init_creds_opt"), where);
             return EINVAL;
         }
     }
diff --git a/src/lib/krb5/krb/gic_opt_set_pa.c b/src/lib/krb5/krb/gic_opt_set_pa.c
index ff4cbf62f6..a60cc3b2f3 100644
--- a/src/lib/krb5/krb/gic_opt_set_pa.c
+++ b/src/lib/krb5/krb/gic_opt_set_pa.c
@@ -118,8 +118,7 @@ krb5_preauth_supply_preauth_data(krb5_context context,
     if (context->preauth_context == NULL) {
         retval = EINVAL;
         krb5int_set_error(&context->err, retval,
-                          "krb5_preauth_supply_preauth_data: "
-                          "Unable to initialize preauth context");
+                          _("Unable to initialize preauth context"));
         return retval;
     }
 
@@ -136,7 +135,8 @@ krb5_preauth_supply_preauth_data(krb5_context context,
              (krb5_get_init_creds_opt *)opte, attr, value);
         if (retval) {
             emsg = krb5_get_error_message(context, retval);
-            krb5int_set_error(&context->err, retval, "Preauth plugin %s: %s",
+            krb5int_set_error(&context->err, retval,
+                              _("Preauth plugin %s: %s"),
                               context->preauth_context->modules[i].name, emsg);
             krb5_free_error_message(context, emsg);
             break;
diff --git a/src/lib/krb5/krb/gic_pwd.c b/src/lib/krb5/krb/gic_pwd.c
index f76f5be00d..519196e227 100644
--- a/src/lib/krb5/krb/gic_pwd.c
+++ b/src/lib/krb5/krb/gic_pwd.c
@@ -46,7 +46,8 @@ krb5_get_as_key_password(krb5_context context,
         if ((ret = krb5_unparse_name(context, client, &clientstr)))
             return(ret);
 
-        snprintf(promptstr, sizeof(promptstr), "Password for %s", clientstr);
+        snprintf(promptstr, sizeof(promptstr), _("Password for %s"),
+                 clientstr);
         free(clientstr);
 
         prompt.prompt = promptstr;
@@ -193,15 +194,15 @@ warn_pw_expiry(krb5_context context, krb5_get_init_creds_opt *options,
     delta = pw_exp - now;
     if (delta < 3600) {
         snprintf(banner, sizeof(banner),
-                 "Warning: Your password will expire in less than one hour "
-                 "on %s", ts);
+                 _("Warning: Your password will expire in less than one hour "
+                   "on %s"), ts);
     } else if (delta < 86400*2) {
         snprintf(banner, sizeof(banner),
-                 "Warning: Your password will expire in %d hour%s on %s",
+                 _("Warning: Your password will expire in %d hour%s on %s"),
                  delta / 3600, delta < 7200 ? "" : "s", ts);
     } else {
         snprintf(banner, sizeof(banner),
-                 "Warning: Your password will expire in %d days on %s",
+                 _("Warning: Your password will expire in %d days on %s"),
                  delta / 86400, ts);
     }
 
@@ -346,17 +347,17 @@ krb5_get_init_creds_password(krb5_context context,
                                       &use_master, NULL)))
         goto cleanup;
 
-    prompt[0].prompt = "Enter new password";
+    prompt[0].prompt = _("Enter new password");
     prompt[0].hidden = 1;
     prompt[0].reply = &pw0;
     prompt_types[0] = KRB5_PROMPT_TYPE_NEW_PASSWORD;
 
-    prompt[1].prompt = "Enter it again";
+    prompt[1].prompt = _("Enter it again");
     prompt[1].hidden = 1;
     prompt[1].reply = &pw1;
     prompt_types[1] = KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN;
 
-    strlcpy(banner, "Password expired.  You must change it now.",
+    strlcpy(banner, _("Password expired.  You must change it now."),
             sizeof(banner));
 
     for (tries = 3; tries; tries--) {
@@ -375,11 +376,11 @@ krb5_get_init_creds_password(krb5_context context,
         if (strcmp(pw0.data, pw1.data) != 0) {
             ret = KRB5_LIBOS_BADPWDMATCH;
             snprintf(banner, sizeof(banner),
-                     "%s.  Please try again.", error_message(ret));
+                     _("%s.  Please try again."), error_message(ret));
         } else if (pw0.length == 0) {
             ret = KRB5_CHPW_PWDNULL;
             snprintf(banner, sizeof(banner),
-                     "%s.  Please try again.", error_message(ret));
+                     _("%s.  Please try again."), error_message(ret));
         } else {
             int result_code;
             krb5_data code_string;
@@ -414,7 +415,8 @@ krb5_get_init_creds_password(krb5_context context,
             if (result_string.length > (sizeof(banner)-100))
                 result_string.length = sizeof(banner)-100;
 
-            snprintf(banner, sizeof(banner), "%.*s%s%.*s.  Please try again.\n",
+            snprintf(banner, sizeof(banner),
+                     _("%.*s%s%.*s.  Please try again.\n"),
                      (int) code_string.length, code_string.data,
                      result_string.length ? ": " : "",
                      (int) result_string.length,
diff --git a/src/lib/krb5/krb/parse.c b/src/lib/krb5/krb/parse.c
index 14ac02d4b5..9e1f6ee62a 100644
--- a/src/lib/krb5/krb/parse.c
+++ b/src/lib/krb5/krb/parse.c
@@ -162,7 +162,8 @@ k5_parse_name(krb5_context context, const char *name,
     if (!parsed_realm) {
         if (flags & KRB5_PRINCIPAL_PARSE_REQUIRE_REALM) {
             krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
-                                   "Principal %s is missing required realm", name);
+                                   _("Principal %s is missing required realm"),
+                                   name);
             free(principal->data);
             free(principal);
             return KRB5_PARSE_MALFORMED;
@@ -179,7 +180,7 @@ k5_parse_name(krb5_context context, const char *name,
         realmsize = default_realm_size;
     } else if (flags & KRB5_PRINCIPAL_PARSE_NO_REALM) {
         krb5_set_error_message(context, KRB5_PARSE_MALFORMED,
-                               "Principal %s has realm present", name);
+                               _("Principal %s has realm present"), name);
         free(principal->data);
         free(principal);
         return KRB5_PARSE_MALFORMED;
diff --git a/src/lib/krb5/krb/plugin.c b/src/lib/krb5/krb/plugin.c
index be909f1443..446d4f22e6 100644
--- a/src/lib/krb5/krb/plugin.c
+++ b/src/lib/krb5/krb/plugin.c
@@ -107,7 +107,7 @@ parse_modstr(krb5_context context, const char *modstr,
     sep = strchr(modstr, ':');
     if (sep == NULL) {
         krb5_set_error_message(context, KRB5_PLUGIN_BAD_MODULE_SPEC,
-                               "Invalid module specifier %s", modstr);
+                               _("Invalid module specifier %s"), modstr);
         return KRB5_PLUGIN_BAD_MODULE_SPEC;
     }
 
@@ -318,7 +318,7 @@ k5_plugin_load(krb5_context context, int interface_id, const char *modname,
         }
     }
     krb5_set_error_message(context, KRB5_PLUGIN_NAME_NOTFOUND,
-                           "Could not find %s plugin module named '%s'",
+                           _("Could not find %s plugin module named '%s'"),
                            interface_names[interface_id], modname);
     return KRB5_PLUGIN_NAME_NOTFOUND;
 }
diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index f4896eb96a..82b422eac8 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -1050,30 +1050,30 @@ sam_challenge_banner(krb5_int32 sam_type)
 
     switch (sam_type) {
     case PA_SAM_TYPE_ENIGMA:    /* Enigma Logic */
-        label = "Challenge for Enigma Logic mechanism";
+        label = _("Challenge for Enigma Logic mechanism");
         break;
     case PA_SAM_TYPE_DIGI_PATH: /*  Digital Pathways */
     case PA_SAM_TYPE_DIGI_PATH_HEX: /*  Digital Pathways */
-        label = "Challenge for Digital Pathways mechanism";
+        label = _("Challenge for Digital Pathways mechanism");
         break;
     case PA_SAM_TYPE_ACTIVCARD_DEC: /*  Digital Pathways */
     case PA_SAM_TYPE_ACTIVCARD_HEX: /*  Digital Pathways */
-        label = "Challenge for Activcard mechanism";
+        label = _("Challenge for Activcard mechanism");
         break;
     case PA_SAM_TYPE_SKEY_K0:   /*  S/key where  KDC has key 0 */
-        label = "Challenge for Enhanced S/Key mechanism";
+        label = _("Challenge for Enhanced S/Key mechanism");
         break;
     case PA_SAM_TYPE_SKEY:      /*  Traditional S/Key */
-        label = "Challenge for Traditional S/Key mechanism";
+        label = _("Challenge for Traditional S/Key mechanism");
         break;
     case PA_SAM_TYPE_SECURID:   /*  Security Dynamics */
-        label = "Challenge for Security Dynamics mechanism";
+        label = _("Challenge for Security Dynamics mechanism");
         break;
     case PA_SAM_TYPE_SECURID_PREDICT:   /* predictive Security Dynamics */
-        label = "Challenge for Security Dynamics mechanism";
+        label = _("Challenge for Security Dynamics mechanism");
         break;
     default:
-        label = "Challenge from authentication server";
+        label = _("Challenge from authentication server");
         break;
     }
 
@@ -1161,7 +1161,7 @@ pa_sam_2(krb5_context context, krb5_kdc_req *request, krb5_pa_data *in_padata,
     }
 
     snprintf(name, sizeof(name), "%.*s",
-             SAMDATA(sc2b->sam_type_name, "SAM Authentication",
+             SAMDATA(sc2b->sam_type_name, _("SAM Authentication"),
                      sizeof(name) - 1));
 
     snprintf(banner, sizeof(banner), "%.*s",
diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 83c4ef7143..8696a155b9 100644
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -678,7 +678,7 @@ negotiate_etype(krb5_context context,
                                        enctype_name,
                                        sizeof(enctype_name)) == 0)
                 krb5_set_error_message(context, KRB5_NOPERM_ETYPE,
-                                       "Encryption type %s not permitted",
+                                       _("Encryption type %s not permitted"),
                                        enctype_name);
             return KRB5_NOPERM_ETYPE;
         }
diff --git a/src/lib/krb5/os/locate_kdc.c b/src/lib/krb5/os/locate_kdc.c
index 4c5977ab05..c2ae0fadb8 100644
--- a/src/lib/krb5/os/locate_kdc.c
+++ b/src/lib/krb5/os/locate_kdc.c
@@ -622,8 +622,8 @@ k5_locate_server(krb5_context context, const krb5_data *realm,
     if (al.nservers == 0) {       /* No good servers */
         k5_free_serverlist(&al);
         krb5_set_error_message(context, KRB5_REALM_CANT_RESOLVE,
-                               "Cannot resolve servers for KDC in "
-                               "realm \"%.*s\"", realm->length, realm->data);
+                               _("Cannot resolve servers for KDC in realm "
+                                 "\"%.*s\""), realm->length, realm->data);
         return KRB5_REALM_CANT_RESOLVE;
     }
     *serverlist = al;
diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
index b2e9fdacb0..a3eb322341 100644
--- a/src/lib/krb5/os/sendto_kdc.c
+++ b/src/lib/krb5/os/sendto_kdc.c
@@ -344,8 +344,8 @@ krb5_sendto_kdc(krb5_context context, const krb5_data *message,
             retval = KRB5KDC_ERR_SVC_UNAVAILABLE;
         } else {
             krb5_set_error_message(context, retval,
-                                   "Cannot contact any KDC for realm '%.*s'",
-                                   realm->length, realm->data);
+                                   _("Cannot contact any KDC for realm "
+                                     "'%.*s'"), realm->length, realm->data);
         }
     }
     if (retval)
diff --git a/src/lib/krb5/rcache/rc_io.c b/src/lib/krb5/rcache/rc_io.c
index 7df5848c8a..ef7ce0b9dc 100644
--- a/src/lib/krb5/rcache/rc_io.c
+++ b/src/lib/krb5/rcache/rc_io.c
@@ -103,16 +103,15 @@ krb5_rc_io_mkstemp(krb5_context context, krb5_rc_iostuff *d, char *dir)
     retval = fstat(d->fd, &stbuf);
     if (retval) {
         krb5_set_error_message(context, retval,
-                               "Cannot fstat replay cache file %s: %s",
+                               _("Cannot fstat replay cache file %s: %s"),
                                d->fn, strerror(errno));
         return KRB5_RC_IO_UNKNOWN;
     }
     if (stbuf.st_mode & 077) {
         krb5_set_error_message(context, retval,
-                               "Insecure mkstemp() file mode "
-                               "for replay cache file %s; "
-                               "try running this program "
-                               "with umask 077 ", d->fn);
+                               _("Insecure mkstemp() file mode for replay "
+                                 "cache file %s; try running this program "
+                                 "with umask 077 "), d->fn);
         return KRB5_RC_IO_UNKNOWN;
     }
 #endif
@@ -143,13 +142,13 @@ rc_map_errno (krb5_context context, int e, const char *fn,
     case EROFS:
     case EEXIST:
         krb5_set_error_message(context, KRB5_RC_IO_PERM,
-                               "Cannot %s replay cache file %s: %s",
+                               _("Cannot %s replay cache file %s: %s"),
                                operation, fn, strerror(e));
         return KRB5_RC_IO_PERM;
 
     default:
         krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
-                               "Cannot %s replay cache: %s",
+                               _("Cannot %s replay cache: %s"),
                                operation, strerror(e));
         return KRB5_RC_IO_UNKNOWN;
     }
@@ -269,14 +268,15 @@ krb5_rc_io_open_internal(krb5_context context, krb5_rc_iostuff *d, char *fn,
     }
     /* check that non other can read/write/execute the file */
     if (sb1.st_mode & 077) {
-        krb5_set_error_message(context, retval, "Insecure file mode "
-                               "for replay cache file %s", d->fn);
+        krb5_set_error_message(context, retval,
+                               _("Insecure file mode for replay cache file "
+                                 "%s"), d->fn);
         return KRB5_RC_IO_UNKNOWN;
     }
     /* owned by me */
     if (sb1.st_uid != geteuid()) {
         retval = KRB5_RC_IO_PERM;
-        krb5_set_error_message(context, retval, "rcache not owned by %d",
+        krb5_set_error_message(context, retval, _("rcache not owned by %d"),
                                (int)geteuid());
         goto cleanup;
     }
@@ -400,18 +400,18 @@ krb5_rc_io_write(krb5_context context, krb5_rc_iostuff *d, krb5_pointer buf,
         case EFBIG:
         case ENOSPC:
             krb5_set_error_message (context, KRB5_RC_IO_SPACE,
-                                    "Can't write to replay cache: %s",
+                                    _("Can't write to replay cache: %s"),
                                     strerror(errno));
             return KRB5_RC_IO_SPACE;
         case EIO:
             krb5_set_error_message (context, KRB5_RC_IO_IO,
-                                    "Can't write to replay cache: %s",
+                                    _("Can't write to replay cache: %s"),
                                     strerror(errno));
             return KRB5_RC_IO_IO;
         case EBADF:
         default:
             krb5_set_error_message (context, KRB5_RC_IO_UNKNOWN,
-                                    "Can't write to replay cache: %s",
+                                    _("Can't write to replay cache: %s"),
                                     strerror(errno));
             return KRB5_RC_IO_UNKNOWN;
         }
@@ -433,7 +433,7 @@ krb5_rc_io_sync(krb5_context context, krb5_rc_iostuff *d)
         case EIO: return KRB5_RC_IO_IO;
         default:
             krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
-                                   "Cannot sync replay cache file: %s",
+                                   _("Cannot sync replay cache file: %s"),
                                    strerror(errno));
             return KRB5_RC_IO_UNKNOWN;
         }
@@ -453,7 +453,7 @@ krb5_rc_io_read(krb5_context context, krb5_rc_iostuff *d, krb5_pointer buf,
         case EBADF:
         default:
             krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
-                                   "Can't read from replay cache: %s",
+                                   _("Can't read from replay cache: %s"),
                                    strerror(errno));
             return KRB5_RC_IO_UNKNOWN;
         }
@@ -485,20 +485,20 @@ krb5_rc_io_destroy(krb5_context context, krb5_rc_iostuff *d)
         {
         case EIO:
             krb5_set_error_message(context, KRB5_RC_IO_IO,
-                                   "Can't destroy replay cache: %s",
+                                   _("Can't destroy replay cache: %s"),
                                    strerror(errno));
             return KRB5_RC_IO_IO;
         case EPERM:
         case EBUSY:
         case EROFS:
             krb5_set_error_message(context, KRB5_RC_IO_PERM,
-                                   "Can't destroy replay cache: %s",
+                                   _("Can't destroy replay cache: %s"),
                                    strerror(errno));
             return KRB5_RC_IO_PERM;
         case EBADF:
         default:
             krb5_set_error_message(context, KRB5_RC_IO_UNKNOWN,
-                                   "Can't destroy replay cache: %s",
+                                   _("Can't destroy replay cache: %s"),
                                    strerror(errno));
             return KRB5_RC_IO_UNKNOWN;
         }
diff --git a/src/plugins/kdb/db2/kdb_db2.c b/src/plugins/kdb/db2/kdb_db2.c
index 0f2d7ce8ee..c7756f5950 100644
--- a/src/plugins/kdb/db2/kdb_db2.c
+++ b/src/plugins/kdb/db2/kdb_db2.c
@@ -231,7 +231,7 @@ configure_context(krb5_context context, char *conf_section, char **db_args)
         } else {
             status = EINVAL;
             krb5_set_error_message(context, status,
-                                   "Unsupported argument \"%s\" for db2",
+                                   _("Unsupported argument \"%s\" for db2"),
                                    opt ? opt : val);
             goto cleanup;
         }
@@ -824,7 +824,7 @@ krb5_db2_put_principal(krb5_context context, krb5_db_entry *entry,
     if (db_args) {
         /* DB2 does not support db_args DB arguments for principal */
         krb5_set_error_message(context, EINVAL,
-                               "Unsupported argument \"%s\" for db2",
+                               _("Unsupported argument \"%s\" for db2"),
                                db_args[0]);
         return EINVAL;
     }
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
index 9a532a619e..73b0d2f644 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
@@ -67,7 +67,8 @@ init_ldap_realm(int argc, char *argv[])
         retval = krb5_ldap_read_krbcontainer_params (util_context,
                                                      &(ldap_context->krbcontainer));
         if (retval != 0) {
-            com_err(progname, retval, "while reading kerberos container information");
+            com_err(progname, retval,
+                    _("while reading kerberos container information"));
             goto cleanup;
         }
     }
@@ -127,7 +128,7 @@ kdb5_ldap_create_policy(int argc, char *argv[])
             date = get_date(argv[i]);
             if (date == (time_t)(-1)) {
                 retval = EINVAL;
-                com_err (me, retval, "while providing time specification");
+                com_err(me, retval, _("while providing time specification"));
                 goto err_nomsg;
             }
 
@@ -141,7 +142,7 @@ kdb5_ldap_create_policy(int argc, char *argv[])
             date = get_date(argv[i]);
             if (date == (time_t)(-1)) {
                 retval = EINVAL;
-                com_err (me, retval, "while providing time specification");
+                com_err(me, retval, _("while providing time specification"));
                 goto err_nomsg;
             }
 
@@ -266,7 +267,7 @@ kdb5_ldap_create_policy(int argc, char *argv[])
             policyparams->policy = strdup(argv[i]);
             if (policyparams->policy == NULL) {
                 retval = ENOMEM;
-                com_err(me, retval, "while creating policy object");
+                com_err(me, retval, _("while creating policy object"));
                 goto err_nomsg;
             }
         }
@@ -277,7 +278,7 @@ kdb5_ldap_create_policy(int argc, char *argv[])
         goto err_usage;
 
     if ((retval = init_ldap_realm (argc, argv))) {
-        com_err(me, retval, "while reading realm information");
+        com_err(me, retval, _("while reading realm information"));
         goto err_nomsg;
     }
 
@@ -302,7 +303,7 @@ cleanup:
 
     if (retval) {
         if (!no_msg)
-            com_err(me, retval, "while creating policy object");
+            com_err(me, retval, _("while creating policy object"));
 
         exit_status++;
     }
@@ -346,7 +347,7 @@ kdb5_ldap_destroy_policy(int argc, char *argv[])
             policy = strdup(argv[i]);
             if (policy == NULL) {
                 retval = ENOMEM;
-                com_err(me, retval, "while destroying policy object");
+                com_err(me, retval, _("while destroying policy object"));
                 goto err_nomsg;
             }
         }
@@ -356,8 +357,9 @@ kdb5_ldap_destroy_policy(int argc, char *argv[])
         goto err_usage;
 
     if (!force) {
-        printf("This will delete the policy object '%s', are you sure?\n", policy);
-        printf("(type 'yes' to confirm)? ");
+        printf(_("This will delete the policy object '%s', are you sure?\n"),
+               policy);
+        printf(_("(type 'yes' to confirm)? "));
 
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
             retval = EINVAL;
@@ -404,7 +406,7 @@ cleanup:
 
     if (retval) {
         if (!no_msg)
-            com_err(me, retval, "while destroying policy object");
+            com_err(me, retval, _("while destroying policy object"));
 
         exit_status++;
     }
@@ -470,7 +472,7 @@ kdb5_ldap_modify_policy(int argc, char *argv[])
             policy = strdup(argv[i]);
             if (policy == NULL) {
                 retval = ENOMEM;
-                com_err(me, retval, "while modifying policy object");
+                com_err(me, retval, _("while modifying policy object"));
                 goto err_nomsg;
             }
         }
@@ -484,7 +486,8 @@ kdb5_ldap_modify_policy(int argc, char *argv[])
 
     retval = krb5_ldap_read_policy(util_context, policy, &policyparams, &in_mask);
     if (retval) {
-        com_err(me, retval, "while reading information of policy '%s'", policy);
+        com_err(me, retval, _("while reading information of policy '%s'"),
+                policy);
         goto err_nomsg;
     }
 
@@ -500,7 +503,7 @@ kdb5_ldap_modify_policy(int argc, char *argv[])
             date = get_date(argv[i]);
             if (date == (time_t)(-1)) {
                 retval = EINVAL;
-                com_err (me, retval, "while providing time specification");
+                com_err(me, retval, _("while providing time specification"));
                 goto err_nomsg;
             }
 
@@ -514,7 +517,7 @@ kdb5_ldap_modify_policy(int argc, char *argv[])
             date = get_date(argv[i]);
             if (date == (time_t)(-1)) {
                 retval = EINVAL;
-                com_err (me, retval, "while providing time specification");
+                com_err(me, retval, _("while providing time specification"));
                 goto err_nomsg;
             }
 
@@ -659,7 +662,7 @@ cleanup:
 
     if (retval) {
         if (!no_msg)
-            com_err(me, retval, "while modifying policy object");
+            com_err(me, retval, _("while modifying policy object"));
 
         exit_status++;
     }
@@ -688,7 +691,7 @@ kdb5_ldap_view_policy(int argc, char *argv[])
 
     policy = strdup(argv[1]);
     if (policy == NULL) {
-        com_err(me, ENOMEM, "while viewing policy");
+        com_err(me, ENOMEM, _("while viewing policy"));
         exit_status++;
         goto cleanup;
     }
@@ -697,7 +700,7 @@ kdb5_ldap_view_policy(int argc, char *argv[])
         goto cleanup;
 
     if ((retval = krb5_ldap_read_policy(util_context, policy, &policyparams, &mask))) {
-        com_err(me, retval, "while viewing policy '%s'", policy);
+        com_err(me, retval, _("while viewing policy '%s'"), policy);
         exit_status++;
         goto cleanup;
     }
@@ -835,7 +838,7 @@ cleanup:
     }
 
     if (retval) {
-        com_err(me, retval, "while listing policy objects");
+        com_err(me, retval, _("while listing policy objects"));
         exit_status++;
     }
 
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
index 05a6c7125d..84ecb66dc4 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
@@ -170,7 +170,7 @@ get_ticket_policy(krb5_ldap_realm_params *rparams, int *i, char *argv[],
         date = get_date(argv[*i]);
         if (date == (time_t)(-1)) {
             retval = EINVAL;
-            com_err (me, retval, "while providing time specification");
+            com_err(me, retval, _("while providing time specification"));
             goto err_nomsg;
         }
         rparams->max_life = date-now;
@@ -185,7 +185,7 @@ get_ticket_policy(krb5_ldap_realm_params *rparams, int *i, char *argv[],
         date = get_date(argv[*i]);
         if (date == (time_t)(-1)) {
             retval = EINVAL;
-            com_err (me, retval, "while providing time specification");
+            com_err(me, retval, _("while providing time specification"));
             goto err_nomsg;
         }
         rparams->max_renewable_life = date-now;
@@ -373,7 +373,7 @@ kdb5_ldap_create(int argc, char *argv[])
             } else if (strncmp(argv[i], "", strlen(argv[i]))==0) {
                 /* dont allow subtree value to be set at the root(NULL, "") of the tree */
                 com_err(progname, EINVAL,
-                        "for subtree while creating realm '%s'",
+                        _("for subtree while creating realm '%s'"),
                         global_params.realm);
                 goto err_nomsg;
             }
@@ -385,7 +385,7 @@ kdb5_ldap_create(int argc, char *argv[])
             if (strncmp(argv[i], "", strlen(argv[i]))==0) {
                 /* dont allow containerref value to be set at the root(NULL, "") of the tree */
                 com_err(progname, EINVAL,
-                        "for container reference while creating realm '%s'",
+                        _("for container reference while creating realm '%s'"),
                         global_params.realm);
                 goto err_nomsg;
             }
@@ -409,8 +409,8 @@ kdb5_ldap_create(int argc, char *argv[])
                 rparams->search_scope = atoi(argv[i]);
                 if ((rparams->search_scope != 1) &&
                     (rparams->search_scope != 2)) {
-                    com_err(progname, EINVAL,
-                            "invalid search scope while creating realm '%s'",
+                    com_err(progname, EINVAL, _("invalid search scope while "
+                                                "creating realm '%s'"),
                             global_params.realm);
                     goto err_nomsg;
                 }
@@ -472,7 +472,7 @@ kdb5_ldap_create(int argc, char *argv[])
         }
 
         else {
-            printf("'%s' is an invalid option\n", argv[i]);
+            printf(_("'%s' is an invalid option\n"), argv[i]);
             goto err_usage;
         }
     }
@@ -492,12 +492,12 @@ kdb5_ldap_create(int argc, char *argv[])
     krb5_princ_set_realm_data(util_context, &db_create_princ, global_params.realm);
     krb5_princ_set_realm_length(util_context, &db_create_princ, strlen(global_params.realm));
 
-    printf("Initializing database for realm '%s'\n", global_params.realm);
+    printf(_("Initializing database for realm '%s'\n"), global_params.realm);
 
     if (!mkey_password) {
         unsigned int pw_size;
-        printf("You will be prompted for the database Master Password.\n");
-        printf("It is important that you NOT FORGET this password.\n");
+        printf(_("You will be prompted for the database Master Password.\n"));
+        printf(_("It is important that you NOT FORGET this password.\n"));
         fflush(stdout);
 
         pw_size = sizeof (pw_str);
@@ -506,7 +506,8 @@ kdb5_ldap_create(int argc, char *argv[])
         retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2,
                                     pw_str, &pw_size);
         if (retval) {
-            com_err(progname, retval, "while reading master key from keyboard");
+            com_err(progname, retval,
+                    _("while reading master key from keyboard"));
             goto err_nomsg;
         }
         mkey_password = pw_str;
@@ -515,7 +516,7 @@ kdb5_ldap_create(int argc, char *argv[])
     rparams->realm_name = strdup(global_params.realm);
     if (rparams->realm_name == NULL) {
         retval = ENOMEM;
-        com_err(progname, ENOMEM, "while creating realm '%s'",
+        com_err(progname, ENOMEM, _("while creating realm '%s'"),
                 global_params.realm);
         goto err_nomsg;
     }
@@ -554,12 +555,12 @@ kdb5_ldap_create(int argc, char *argv[])
             }
         }
 
-        printf("\nKerberos container is missing. Creating now...\n");
+        printf(_("\nKerberos container is missing. Creating now...\n"));
         if (kparams.DN == NULL) {
 #ifdef HAVE_EDIRECTORY
             printf("Enter DN of Kerberos container [cn=Kerberos,cn=Security]: ");
 #else
-            printf("Enter DN of Kerberos container: ");
+            printf(_("Enter DN of Kerberos container: "));
 #endif
             if (fgets(krb_location, MAX_KRB_CONTAINER_LEN, stdin) != NULL) {
                 /* Remove the newline character at the end */
@@ -587,11 +588,13 @@ kdb5_ldap_create(int argc, char *argv[])
         retval = krb5_ldap_read_krbcontainer_params(util_context,
                                                     &(ldap_context->krbcontainer));
         if (retval) {
-            com_err(progname, retval, "while reading kerberos container information");
+            com_err(progname, retval,
+                    _("while reading kerberos container information"));
             goto cleanup;
         }
     } else if (retval) {
-        com_err(progname, retval, "while reading kerberos container information");
+        com_err(progname, retval,
+                _("while reading kerberos container information"));
         goto cleanup;
     }
 
@@ -607,7 +610,7 @@ kdb5_ldap_create(int argc, char *argv[])
                                               global_params.realm,
                                               &(ldap_context->lrparams),
                                               &mask))) {
-        com_err(progname, retval, "while reading information of realm '%s'",
+        com_err(progname, retval, _("while reading information of realm '%s'"),
                 global_params.realm);
         goto err_nomsg;
     }
@@ -622,7 +625,7 @@ kdb5_ldap_create(int argc, char *argv[])
                                           global_params.mkey_name,
                                           global_params.realm,
                                           0, &master_princ))) {
-        com_err(progname, retval, "while setting up master key name");
+        com_err(progname, retval, _("while setting up master key name"));
         goto err_nomsg;
     }
 
@@ -634,7 +637,7 @@ kdb5_ldap_create(int argc, char *argv[])
         pwd.length = strlen(mkey_password);
         retval = krb5_principal2salt(util_context, master_princ, &master_salt);
         if (retval) {
-            com_err(progname, retval, "while calculating master key salt");
+            com_err(progname, retval, _("while calculating master key salt"));
             goto err_nomsg;
         }
 
@@ -645,7 +648,8 @@ kdb5_ldap_create(int argc, char *argv[])
             free(master_salt.data);
 
         if (retval) {
-            com_err(progname, retval, "while transforming master key from password");
+            com_err(progname, retval,
+                    _("while transforming master key from password"));
             goto err_nomsg;
         }
 
@@ -680,7 +684,8 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, master_princ,
                                                 MASTER_KEY, &rblock,
                                                 &master_keyblock))) {
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
 
@@ -689,14 +694,16 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, &tgt_princ,
                                                 TGT_KEY, &rblock,
                                                 &master_keyblock))) {
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
 
         /* Create 'kadmin/admin' ... */
         snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_ADMIN_SERVICE, global_params.realm);
         if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         rblock.max_life = ADMIN_LIFETIME;
@@ -704,7 +711,8 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY,
                                                 &rblock, &master_keyblock))) {
             krb5_free_principal(util_context, p);
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         krb5_free_principal(util_context, p);
@@ -712,7 +720,8 @@ kdb5_ldap_create(int argc, char *argv[])
         /* Create 'kadmin/changepw' ... */
         snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_CHANGEPW_SERVICE, global_params.realm);
         if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         rblock.max_life = CHANGEPW_LIFETIME;
@@ -721,7 +730,8 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY,
                                                 &rblock, &master_keyblock))) {
             krb5_free_principal(util_context, p);
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         krb5_free_principal(util_context, p);
@@ -729,7 +739,8 @@ kdb5_ldap_create(int argc, char *argv[])
         /* Create 'kadmin/history' ... */
         snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_HIST_PRINCIPAL, global_params.realm);
         if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         rblock.max_life = global_params.max_life;
@@ -737,19 +748,22 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY,
                                                 &rblock, &master_keyblock))) {
             krb5_free_principal(util_context, p);
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         krb5_free_principal(util_context, p);
 
         /* Create 'kadmin/<hostname>' ... */
         if ((retval=krb5_sname_to_principal(util_context, NULL, "kadmin", KRB5_NT_SRV_HST, &p))) {
-            com_err(progname, retval, "krb5_sname_to_principal, while adding entries to the database");
+            com_err(progname, retval, _("krb5_sname_to_principal, while "
+                                        "adding entries to the database"));
             goto err_nomsg;
         }
 
         if ((retval=krb5_copy_principal(util_context, p, &temp_p))) {
-            com_err(progname, retval, "krb5_copy_principal, while adding entries to the database");
+            com_err(progname, retval, _("krb5_copy_principal, while adding "
+                                        "entries to the database"));
             goto err_nomsg;
         }
 
@@ -758,7 +772,8 @@ kdb5_ldap_create(int argc, char *argv[])
         temp_p->realm.length = strlen(util_context->default_realm);
         temp_p->realm.data = strdup(util_context->default_realm);
         if (temp_p->realm.data == NULL) {
-            com_err(progname, ENOMEM, "while adding entries to the database");
+            com_err(progname, ENOMEM,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
 
@@ -767,7 +782,8 @@ kdb5_ldap_create(int argc, char *argv[])
         if ((retval = kdb_ldap_create_principal(util_context, temp_p, TGT_KEY,
                                                 &rblock, &master_keyblock))) {
             krb5_free_principal(util_context, p);
-            com_err(progname, retval, "while adding entries to the database");
+            com_err(progname, retval,
+                    _("while adding entries to the database"));
             goto err_nomsg;
         }
         krb5_free_principal(util_context, temp_p);
@@ -783,7 +799,7 @@ kdb5_ldap_create(int argc, char *argv[])
     if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) ||
         (mask & LDAP_REALM_PASSWDSERVERS)) {
 
-        printf("Changing rights for the service object. Please wait ... ");
+        printf(_("Changing rights for the service object. Please wait ... "));
         fflush(stdout);
 
         rightsmask =0;
@@ -794,8 +810,9 @@ kdb5_ldap_create(int argc, char *argv[])
                 if ((retval=krb5_ldap_add_service_rights(util_context,
                                                          LDAP_KDC_SERVICE, rparams->kdcservers[i],
                                                          rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     goto err_nomsg;
                 }
@@ -810,8 +827,9 @@ kdb5_ldap_create(int argc, char *argv[])
                 if ((retval=krb5_ldap_add_service_rights(util_context,
                                                          LDAP_ADMIN_SERVICE, rparams->adminservers[i],
                                                          rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     goto err_nomsg;
                 }
@@ -826,15 +844,16 @@ kdb5_ldap_create(int argc, char *argv[])
                 if ((retval=krb5_ldap_add_service_rights(util_context,
                                                          LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
                                                          rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     goto err_nomsg;
                 }
             }
         }
 
-        printf("done\n");
+        printf(_("done\n"));
     }
 #endif
     /* The Realm creation is completed. Here is the end of transaction */
@@ -858,8 +877,8 @@ kdb5_ldap_create(int argc, char *argv[])
                                           mkey_kvno,
                                           &master_keyblock, NULL);
         if (retval) {
-            com_err(progname, errno, "while storing key");
-            printf("Warning: couldn't stash master key.\n");
+            com_err(progname, errno, _("while storing key"));
+            printf(_("Warning: couldn't stash master key.\n"));
         }
     }
 
@@ -887,7 +906,7 @@ cleanup:
 
     if (retval) {
         if (!no_msg) {
-            com_err(progname, retval, "while creating realm '%s'",
+            com_err(progname, retval, _("while creating realm '%s'"),
                     global_params.realm);
         }
         exit_status++;
@@ -940,7 +959,8 @@ kdb5_ldap_modify(int argc, char *argv[])
 
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
                                                      &(ldap_context->krbcontainer)))) {
-        com_err(progname, retval, "while reading Kerberos container information");
+        com_err(progname, retval,
+                _("while reading Kerberos container information"));
         goto err_nomsg;
     }
 
@@ -995,7 +1015,7 @@ kdb5_ldap_modify(int argc, char *argv[])
             } else if (strncmp(argv[i], "", strlen(argv[i]))==0) {
                 /* dont allow subtree value to be set at the root(NULL, "") of the tree */
                 com_err(progname, EINVAL,
-                        "for subtree while modifying realm '%s'",
+                        _("for subtree while modifying realm '%s'"),
                         global_params.realm);
                 goto err_nomsg;
             }
@@ -1006,8 +1026,8 @@ kdb5_ldap_modify(int argc, char *argv[])
                 goto err_usage;
             if (strncmp(argv[i], "", strlen(argv[i]))==0) {
                 /* dont allow containerref value to be set at the root(NULL, "") of the tree */
-                com_err(progname, EINVAL,
-                        "for container reference while modifying realm '%s'",
+                com_err(progname, EINVAL, _("for container reference while "
+                                            "modifying realm '%s'"),
                         global_params.realm);
                 goto err_nomsg;
             }
@@ -1038,7 +1058,8 @@ kdb5_ldap_modify(int argc, char *argv[])
                     (rparams->search_scope != 2)) {
                     retval = EINVAL;
                     com_err(progname, retval,
-                            "specified for search scope while modifying information of realm '%s'",
+                            _("specified for search scope while modifying "
+                              "information of realm '%s'"),
                             global_params.realm);
                     goto err_nomsg;
                 }
@@ -1422,7 +1443,7 @@ kdb5_ldap_modify(int argc, char *argv[])
         else if ((ret_mask= get_ticket_policy(rparams,&i,argv,argc)) !=0) {
             mask|=ret_mask;
         } else {
-            printf("'%s' is an invalid option\n", argv[i]);
+            printf(_("'%s' is an invalid option\n"), argv[i]);
             goto err_usage;
         }
     }
@@ -1436,7 +1457,7 @@ kdb5_ldap_modify(int argc, char *argv[])
     if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_CONTREF) || (mask & LDAP_REALM_KDCSERVERS) ||
         (mask & LDAP_REALM_ADMINSERVERS) || (mask & LDAP_REALM_PASSWDSERVERS)) {
 
-        printf("Changing rights for the service object. Please wait ... ");
+        printf(_("Changing rights for the service object. Please wait ... "));
         fflush(stdout);
 
         if ((mask & LDAP_REALM_SUBTREE) || (mask & LDAP_REALM_CONTREF)) {
@@ -1458,8 +1479,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                             if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                         LDAP_KDC_SERVICE, kdcdns[i],
                                                                         rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                                printf("failed\n");
-                                com_err(progname, retval, "while assigning rights '%s'",
+                                printf(_("failed\n"));
+                                com_err(progname, retval,
+                                        _("while assigning rights '%s'"),
                                         rparams->realm_name);
                                 goto err_nomsg;
                             }
@@ -1469,8 +1491,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_KDC_SERVICE, kdcdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1509,8 +1532,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                     LDAP_KDC_SERVICE, oldkdcdns[i],
                                                                     rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1520,8 +1544,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_KDC_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1537,8 +1562,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_KDC_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1557,8 +1583,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                     LDAP_KDC_SERVICE, oldkdcdns[i],
                                                                     rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1568,8 +1595,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                     if ((retval=krb5_ldap_add_service_rights(util_context,
                                                              LDAP_KDC_SERVICE, newdns[i],
                                                              rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                        printf("failed\n");
-                        com_err(progname, retval, "while assigning rights '%s'",
+                        printf(_("failed\n"));
+                        com_err(progname, retval,
+                                _("while assigning rights '%s'"),
                                 rparams->realm_name);
                         goto err_nomsg;
                     }
@@ -1592,8 +1620,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                             if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                         LDAP_ADMIN_SERVICE, admindns[i],
                                                                         rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                                printf("failed\n");
-                                com_err(progname, retval, "while assigning rights '%s'",
+                                printf(_("failed\n"));
+                                com_err(progname, retval,
+                                        _("while assigning rights '%s'"),
                                         rparams->realm_name);
                                 goto err_nomsg;
                             }
@@ -1603,8 +1632,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_ADMIN_SERVICE, admindns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1643,8 +1673,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                     LDAP_ADMIN_SERVICE, oldadmindns[i],
                                                                     rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1654,8 +1685,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_ADMIN_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1671,8 +1703,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_ADMIN_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1691,8 +1724,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                     LDAP_ADMIN_SERVICE, oldadmindns[i],
                                                                     rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1702,8 +1736,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                     if ((retval=krb5_ldap_add_service_rights(util_context,
                                                              LDAP_ADMIN_SERVICE, newdns[i],
                                                              rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                        printf("failed\n");
-                        com_err(progname, retval, "while assigning rights '%s'",
+                        printf(_("failed\n"));
+                        com_err(progname, retval,
+                                _("while assigning rights '%s'"),
                                 rparams->realm_name);
                         goto err_nomsg;
                     }
@@ -1726,8 +1761,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                             if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                         LDAP_PASSWD_SERVICE, passwddns[i],
                                                                         rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                                printf("failed\n");
-                                com_err(progname, retval, "while assigning rights '%s'",
+                                printf(_("failed\n"));
+                                com_err(progname, retval,
+                                        _("while assigning rights '%s'"),
                                         rparams->realm_name);
                                 goto err_nomsg;
                             }
@@ -1737,8 +1773,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_PASSWD_SERVICE, passwddns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1777,8 +1814,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_delete_service_rights(util_context,
                                                                     LDAP_PASSWD_SERVICE, oldpwddns[i],
                                                                     rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1788,8 +1826,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_PASSWD_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             FREE_DN_LIST(newdns);
                             goto err_nomsg;
@@ -1805,8 +1844,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval=krb5_ldap_add_service_rights(util_context,
                                                                  LDAP_PASSWD_SERVICE, newdns[i],
                                                                  rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1825,8 +1865,9 @@ kdb5_ldap_modify(int argc, char *argv[])
                         if ((retval = krb5_ldap_delete_service_rights(util_context,
                                                                       LDAP_PASSWD_SERVICE, oldpwddns[i],
                                                                       rparams->realm_name, oldsubtrees, oldcontainerref, rightsmask)) != 0) {
-                            printf("failed\n");
-                            com_err(progname, retval, "while assigning rights '%s'",
+                            printf(_("failed\n"));
+                            com_err(progname, retval,
+                                    _("while assigning rights '%s'"),
                                     rparams->realm_name);
                             goto err_nomsg;
                         }
@@ -1836,15 +1877,16 @@ kdb5_ldap_modify(int argc, char *argv[])
                     if ((retval = krb5_ldap_add_service_rights(util_context,
                                                                LDAP_PASSWD_SERVICE, newdns[i],
                                                                rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                        printf("failed\n");
-                        com_err(progname, retval, "while assigning rights '%s'",
+                        printf(_("failed\n"));
+                        com_err(progname, retval,
+                                _("while assigning rights '%s'"),
                                 rparams->realm_name);
                         goto err_nomsg;
                     }
                 }
             }
         }
-        printf("done\n");
+        printf(_("done\n"));
     }
 #endif
 
@@ -1908,7 +1950,8 @@ cleanup:
 
     if (retval) {
         if (!no_msg)
-            com_err(progname, retval, "while modifying information of realm '%s'",
+            com_err(progname, retval,
+                    _("while modifying information of realm '%s'"),
                     global_params.realm);
         exit_status++;
     }
@@ -1934,7 +1977,7 @@ kdb5_ldap_view(int argc, char *argv[])
     ldap_context = (krb5_ldap_context *) dal_handle->db_context;
     if (!(ldap_context)) {
         retval = EINVAL;
-        com_err(progname, retval, "while initializing database");
+        com_err(progname, retval, _("while initializing database"));
         exit_status++;
         return;
     }
@@ -1942,14 +1985,15 @@ kdb5_ldap_view(int argc, char *argv[])
     /* Read the kerberos container information */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
                                                      &(ldap_context->krbcontainer))) != 0) {
-        com_err(progname, retval, "while reading kerberos container information");
+        com_err(progname, retval,
+                _("while reading kerberos container information"));
         exit_status++;
         return;
     }
 
     if ((retval = krb5_ldap_read_realm_params(util_context,
                                               global_params.realm, &rparams, &mask)) || (!rparams)) {
-        com_err(progname, retval, "while reading information of realm '%s'",
+        com_err(progname, retval, _("while reading information of realm '%s'"),
                 global_params.realm);
         exit_status++;
         return;
@@ -1995,24 +2039,25 @@ print_realm_params(krb5_ldap_realm_params *rparams, int mask)
     unsigned int num_entry_printed = 0, i = 0;
 
     /* Print the Realm Attributes on the standard output */
-    printf("%25s: %-50s\n", "Realm Name", global_params.realm);
+    printf("%25s: %-50s\n", _("Realm Name"), global_params.realm);
     if (mask & LDAP_REALM_SUBTREE) {
         for (i=0; rparams->subtree[i]!=NULL; i++)
-            printf("%25s: %-50s\n", "Subtree", rparams->subtree[i]);
+            printf("%25s: %-50s\n", _("Subtree"), rparams->subtree[i]);
     }
     if (mask & LDAP_REALM_CONTREF)
-        printf("%25s: %-50s\n", "Principal Container Reference", rparams->containerref);
+        printf("%25s: %-50s\n", _("Principal Container Reference"),
+               rparams->containerref);
     if (mask & LDAP_REALM_SEARCHSCOPE) {
         if ((rparams->search_scope != 1) &&
             (rparams->search_scope != 2)) {
-            printf("%25s: %-50s\n", "SearchScope", "Invalid !");
+            printf("%25s: %-50s\n", _("SearchScope"), _("Invalid !"));
         } else {
-            printf("%25s: %-50s\n", "SearchScope",
+            printf("%25s: %-50s\n", _("SearchScope"),
                    (rparams->search_scope == 1) ? "ONE" : "SUB");
         }
     }
     if (mask & LDAP_REALM_KDCSERVERS) {
-        printf("%25s:", "KDC Services");
+        printf("%25s:", _("KDC Services"));
         if (rparams->kdcservers != NULL) {
             num_entry_printed = 0;
             for (slist = rparams->kdcservers; *slist != NULL; slist++) {
@@ -2027,7 +2072,7 @@ print_realm_params(krb5_ldap_realm_params *rparams, int mask)
             printf("\n");
     }
     if (mask & LDAP_REALM_ADMINSERVERS) {
-        printf("%25s:", "Admin Services");
+        printf("%25s:", _("Admin Services"));
         if (rparams->adminservers != NULL) {
             num_entry_printed = 0;
             for (slist = rparams->adminservers; *slist != NULL; slist++) {
@@ -2042,7 +2087,7 @@ print_realm_params(krb5_ldap_realm_params *rparams, int mask)
             printf("\n");
     }
     if (mask & LDAP_REALM_PASSWDSERVERS) {
-        printf("%25s:", "Passwd Services");
+        printf("%25s:", _("Passwd Services"));
         if (rparams->passwdservers != NULL) {
             num_entry_printed = 0;
             for (slist = rparams->passwdservers; *slist != NULL; slist++) {
@@ -2058,19 +2103,19 @@ print_realm_params(krb5_ldap_realm_params *rparams, int mask)
     }
 
     if (mask & LDAP_REALM_MAXTICKETLIFE) {
-        printf("%25s:", "Maximum Ticket Life");
+        printf("%25s:", _("Maximum Ticket Life"));
         printf(" %s \n", strdur(rparams->max_life));
     }
 
     if (mask & LDAP_REALM_MAXRENEWLIFE) {
-        printf("%25s:", "Maximum Renewable Life");
+        printf("%25s:", _("Maximum Renewable Life"));
         printf(" %s \n", strdur(rparams->max_renewable_life));
     }
 
     if (mask & LDAP_REALM_KRBTICKETFLAGS) {
         int ticketflags = rparams->tktflags;
 
-        printf("%25s: ", "Ticket flags");
+        printf("%25s: ", _("Ticket flags"));
         if (ticketflags & KRB5_KDB_DISALLOW_POSTDATED)
             printf("%s ","DISALLOW_POSTDATED");
 
@@ -2140,7 +2185,8 @@ kdb5_ldap_list(int argc, char *argv[])
     /* Read the kerberos container information */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
                                                      &(ldap_context->krbcontainer))) != 0) {
-        com_err(progname, retval, "while reading kerberos container information");
+        com_err(progname, retval,
+                _("while reading kerberos container information"));
         exit_status++;
         return;
     }
@@ -2149,7 +2195,7 @@ kdb5_ldap_list(int argc, char *argv[])
     if (retval != 0) {
         krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
         ldap_context->krbcontainer = NULL;
-        com_err (progname, retval, "while listing realms");
+        com_err(progname, retval, _("while listing realms"));
         exit_status++;
         return;
     }
@@ -2498,7 +2544,7 @@ kdb_ldap_create_principal(krb5_context context, krb5_principal princ,
 
     retval = krb5_ldap_put_principal(context, &entry, NULL);
     if (retval) {
-        com_err(NULL, retval, "while adding entries to database");
+        com_err(NULL, retval, _("while adding entries to database"));
         goto cleanup;
     }
 
@@ -2543,8 +2589,9 @@ kdb5_ldap_destroy(int argc, char *argv[])
     }
 
     if (!force) {
-        printf("Deleting KDC database of '%s', are you sure?\n", global_params.realm);
-        printf("(type 'yes' to confirm)? ");
+        printf(_("Deleting KDC database of '%s', are you sure?\n"),
+               global_params.realm);
+        printf(_("(type 'yes' to confirm)? "));
         if (fgets(buf, sizeof(buf), stdin) == NULL) {
             exit_status++;
             return;
@@ -2553,13 +2600,13 @@ kdb5_ldap_destroy(int argc, char *argv[])
             exit_status++;
             return;
         }
-        printf("OK, deleting database of '%s'...\n", global_params.realm);
+        printf(_("OK, deleting database of '%s'...\n"), global_params.realm);
     }
 
     dal_handle = util_context->dal_handle;
     ldap_context = (krb5_ldap_context *) dal_handle->db_context;
     if (!(ldap_context)) {
-        com_err(progname, EINVAL, "while initializing database");
+        com_err(progname, EINVAL, _("while initializing database"));
         exit_status++;
         return;
     }
@@ -2567,7 +2614,8 @@ kdb5_ldap_destroy(int argc, char *argv[])
     /* Read the kerberos container from the LDAP Server */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
                                                      &(ldap_context->krbcontainer))) != 0) {
-        com_err(progname, retval, "while reading kerberos container information");
+        com_err(progname, retval,
+                _("while reading kerberos container information"));
         exit_status++;
         return;
     }
@@ -2575,7 +2623,7 @@ kdb5_ldap_destroy(int argc, char *argv[])
     /* Read the Realm information from the LDAP Server */
     if ((retval = krb5_ldap_read_realm_params(util_context, global_params.realm,
                                               &(ldap_context->lrparams), &mask)) != 0) {
-        com_err(progname, retval, "while reading realm information");
+        com_err(progname, retval, _("while reading realm information"));
         exit_status++;
         return;
     }
@@ -2584,7 +2632,7 @@ kdb5_ldap_destroy(int argc, char *argv[])
     if ((mask & LDAP_REALM_KDCSERVERS) || (mask & LDAP_REALM_ADMINSERVERS) ||
         (mask & LDAP_REALM_PASSWDSERVERS)) {
 
-        printf("Changing rights for the service object. Please wait ... ");
+        printf(_("Changing rights for the service object. Please wait ... "));
         fflush(stdout);
 
         rparams = ldap_context->lrparams;
@@ -2596,8 +2644,9 @@ kdb5_ldap_destroy(int argc, char *argv[])
                 if ((retval = krb5_ldap_delete_service_rights(util_context,
                                                               LDAP_KDC_SERVICE, rparams->kdcservers[i],
                                                               rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     return;
                 }
@@ -2611,8 +2660,9 @@ kdb5_ldap_destroy(int argc, char *argv[])
                 if ((retval = krb5_ldap_delete_service_rights(util_context,
                                                               LDAP_ADMIN_SERVICE, rparams->adminservers[i],
                                                               rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     return;
                 }
@@ -2626,8 +2676,9 @@ kdb5_ldap_destroy(int argc, char *argv[])
                 if ((retval = krb5_ldap_delete_service_rights(util_context,
                                                               LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
                                                               rparams->realm_name, rparams->subtree, rparams->containerref, rightsmask)) != 0) {
-                    printf("failed\n");
-                    com_err(progname, retval, "while assigning rights to '%s'",
+                    printf(_("failed\n"));
+                    com_err(progname, retval,
+                            _("while assigning rights to '%s'"),
                             rparams->realm_name);
                     return;
                 }
@@ -2639,12 +2690,13 @@ kdb5_ldap_destroy(int argc, char *argv[])
     /* Delete the realm container and all the associated principals */
     retval = krb5_ldap_delete_realm(util_context, global_params.realm);
     if (retval) {
-        com_err(progname, retval, "deleting database of '%s'", global_params.realm);
+        com_err(progname, retval,
+                _("deleting database of '%s'"), global_params.realm);
         exit_status++;
         return;
     }
 
-    printf("** Database of '%s' destroyed.\n", global_params.realm);
+    printf(_("** Database of '%s' destroyed.\n"), global_params.realm);
 
     return;
 }
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
index b53be485e3..916a4bd577 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
@@ -1915,13 +1915,15 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
         if (strcmp (argv[1], "-f") == 0) {
             if (((file_name = strdup (argv[2])) == NULL) ||
                 ((service_object = strdup (argv[3])) == NULL)) {
-                com_err(me, ENOMEM, "while setting service object password");
+                com_err(me, ENOMEM,
+                        _("while setting service object password"));
                 goto cleanup;
             }
         } else if (strcmp (argv[2], "-f") == 0) {
             if (((file_name = strdup (argv[3])) == NULL) ||
                 ((service_object = strdup (argv[1])) == NULL)) {
-                com_err(me, ENOMEM, "while setting service object password");
+                com_err(me, ENOMEM,
+                        _("while setting service object password"));
                 goto cleanup;
             }
         } else {
@@ -1929,7 +1931,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
             goto cleanup;
         }
         if (file_name == NULL) {
-            com_err(me, ENOMEM, "while setting service object password");
+            com_err(me, ENOMEM, _("while setting service object password"));
             goto cleanup;
         }
     } else { /* argc == 2 */
@@ -1937,7 +1939,7 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
 
         service_object = strdup (argv[1]);
         if (service_object == NULL) {
-            com_err(me, ENOMEM, "while setting service object password");
+            com_err(me, ENOMEM, _("while setting service object password"));
             goto cleanup;
         }
 
@@ -1952,7 +1954,8 @@ kdb5_ldap_stash_service_password(int argc, char **argv)
                 /* Stash file path neither in krb5.conf nor on command line */
                 file_name = strdup(DEF_SERVICE_PASSWD_FILE);
                 if (file_name == NULL) {
-                    com_err(me, ENOMEM, "while setting service object password");
+                    com_err(me, ENOMEM,
+                            _("while setting service object password"));
                     goto cleanup;
                 }
                 goto done;
@@ -1972,25 +1975,21 @@ done:
         memset(passwd, 0, sizeof (passwd));
         passwd_len = sizeof (passwd);
 
-        /* size of prompt = strlen of servicedn + strlen("Password for \" \"") */
-        assert (sizeof (prompt1) > (strlen (service_object)
-                                    + sizeof ("Password for \" \"")));
-        snprintf(prompt1, sizeof(prompt1), "Password for \"%s\"", service_object);
+        snprintf(prompt1, sizeof(prompt1), _("Password for \"%s\""),
+                 service_object);
 
-        /* size of prompt = strlen of servicedn + strlen("Re-enter Password for \" \"") */
-        assert (sizeof (prompt2) > (strlen (service_object)
-                                    + sizeof ("Re-enter Password for \" \"")));
-        snprintf(prompt2, sizeof(prompt2), "Re-enter password for \"%s\"", service_object);
+        snprintf(prompt2, sizeof(prompt2), _("Re-enter password for \"%s\""),
+                 service_object);
 
         ret = krb5_read_password(util_context, prompt1, prompt2, passwd, &passwd_len);
         if (ret != 0) {
-            com_err(me, ret, "while setting service object password");
+            com_err(me, ret, _("while setting service object password"));
             memset(passwd, 0, sizeof (passwd));
             goto cleanup;
         }
 
         if (passwd_len == 0) {
-            printf("%s: Invalid password\n", me);
+            printf(_("%s: Invalid password\n"), me);
             memset(passwd, 0, MAX_SERVICE_PASSWD_LEN);
             goto cleanup;
         }
@@ -2005,7 +2004,8 @@ done:
 
         ret = tohex(pwd, &hexpasswd);
         if (ret != 0) {
-            com_err(me, ret, "Failed to convert the password to hexadecimal");
+            com_err(me, ret,
+                    _("Failed to convert the password to hexadecimal"));
             memset(passwd, 0, passwd_len);
             goto cleanup;
         }
@@ -2018,7 +2018,7 @@ done:
     old_mode = umask(0177);
     pfile = fopen(file_name, "a+");
     if (pfile == NULL) {
-        com_err(me, errno, "Failed to open file %s: %s", file_name,
+        com_err(me, errno, _("Failed to open file %s: %s"), file_name,
                 strerror (errno));
         goto cleanup;
     }
@@ -2039,12 +2039,14 @@ done:
         if (feof(pfile)) {
             /* If the service object dn is not present in the service password file */
             if (fprintf(pfile, "%s#{HEX}%s\n", service_object, hexpasswd.data) < 0) {
-                com_err(me, errno, "Failed to write service object password to file");
+                com_err(me, errno,
+                        _("Failed to write service object password to file"));
                 fclose(pfile);
                 goto cleanup;
             }
         } else {
-            com_err(me, errno, "Error reading service object password file");
+            com_err(me, errno,
+                    _("Error reading service object password file"));
             fclose(pfile);
             goto cleanup;
         }
@@ -2060,7 +2062,7 @@ done:
 
         /* Create a new file with the extension .tmp */
         if (asprintf(&tmp_file,"%s.tmp",file_name) < 0) {
-            com_err(me, ENOMEM, "while setting service object password");
+            com_err(me, ENOMEM, _("while setting service object password"));
             fclose(pfile);
             goto cleanup;
         }
@@ -2069,7 +2071,7 @@ done:
         newfile = fopen(tmp_file, "w");
         umask (omask);
         if (newfile == NULL) {
-            com_err(me, errno, "Error creating file %s", tmp_file);
+            com_err(me, errno, _("Error creating file %s"), tmp_file);
             fclose(pfile);
             goto cleanup;
         }
@@ -2080,7 +2082,8 @@ done:
             if (((str = strstr(line, service_object)) != NULL) &&
                 (line[strlen(service_object)] == '#')) {
                 if (fprintf(newfile, "%s#{HEX}%s\n", service_object, hexpasswd.data) < 0) {
-                    com_err(me, errno, "Failed to write service object password to file");
+                    com_err(me, errno, _("Failed to write service object "
+                                         "password to file"));
                     fclose(newfile);
                     unlink(tmp_file);
                     fclose(pfile);
@@ -2088,7 +2091,8 @@ done:
                 }
             } else {
                 if (fprintf (newfile, "%s", line) < 0) {
-                    com_err(me, errno, "Failed to write service object password to file");
+                    com_err(me, errno, _("Failed to write service object "
+                                         "password to file"));
                     fclose(newfile);
                     unlink(tmp_file);
                     fclose(pfile);
@@ -2098,7 +2102,8 @@ done:
         }
 
         if (!feof(pfile)) {
-            com_err(me, errno, "Error reading service object password file");
+            com_err(me, errno,
+                    _("Error reading service object password file"));
             fclose(newfile);
             unlink(tmp_file);
             fclose(pfile);
@@ -2112,8 +2117,8 @@ done:
 
         ret = rename(tmp_file, file_name);
         if (ret != 0) {
-            com_err(me, errno, "Failed to write service object password to "
-                    "file");
+            com_err(me, errno,
+                    _("Failed to write service object password to file"));
             goto cleanup;
         }
     }
diff --git a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
index ec261d2661..022b94f80d 100644
--- a/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
+++ b/src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
@@ -102,90 +102,48 @@ krb5_boolean manual_mkey = FALSE;
 void
 usage(void)
 {
-    fprintf(stderr, "Usage: "
-            "kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri]\n"
-            "\tcmd [cmd_options]\n"
+    fprintf(stderr,
+            _("Usage: kdb5_ldap_util [-D user_dn [-w passwd]] [-H ldapuri]\n"
+              "\tcmd [cmd_options]\n"
 
 /* Create realm */
-            "create          [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn]\n"
-#ifdef HAVE_EDIRECTORY
-            "\t\t[-kdcdn kdc_service_list] [-admindn admin_service_list]\n"
-            "\t\t[-pwddn passwd_service_list]\n"
-#endif
-            "\t\t[-m|-P password|-sf stashfilename] [-k mkeytype] [-kv mkeyVNO] [-s]\n"
-            "\t\t[-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life]\n"
-            "\t\t[ticket_flags] [-r realm]\n"
+              "create          [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn]\n"
+              "\t\t[-m|-P password|-sf stashfilename] [-k mkeytype] [-kv mkeyVNO] [-s]\n"
+              "\t\t[-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life]\n"
+              "\t\t[ticket_flags] [-r realm]\n"
 
 /* modify realm */
-            "modify          [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn]\n"
-#ifdef HAVE_EDIRECTORY
-            "\t\t[-kdcdn kdc_service_list |\n"
-            "\t\t[-clearkdcdn kdc_service_list] [-addkdcdn kdc_service_list]]\n"
-            "\t\t[-admindn admin_service_list | [-clearadmindn admin_service_list]\n"
-            "\t\t[-addadmindn admin_service_list]] [-pwddn passwd_service_list |\n"
-            "\t\t[-clearpwddn passwd_service_list] [-addpwddn passwd_service_list]]\n"
-#endif
-            "\t\t[-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life]\n"
-            "\t\t[ticket_flags] [-r realm]\n"
+              "modify          [-subtrees subtree_dn_list] [-sscope search_scope] [-containerref container_reference_dn]\n"
+              "\t\t[-maxtktlife max_ticket_life] [-maxrenewlife max_renewable_ticket_life]\n"
+              "\t\t[ticket_flags] [-r realm]\n"
 /* View realm */
-            "view            [-r realm]\n"
+              "view            [-r realm]\n"
 
 /* Destroy realm */
-            "destroy                [-f] [-r realm]\n"
+              "destroy                [-f] [-r realm]\n"
 
 /* List realms */
-            "list\n"
-
-#ifdef HAVE_EDIRECTORY
-/* Create Service */
-            "create_service  {-kdc|-admin|-pwd} [-servicehost service_host_list]\n"
-            "\t\t[-realm realm_list] \n"
-            "\t\t[-randpw|-fileonly] [-f filename] service_dn\n"
-
-/* Modify service */
-            "modify_service  [-servicehost service_host_list |\n"
-            "\t\t[-clearservicehost service_host_list]\n"
-            "\t\t[-addservicehost service_host_list]]\n"
-            "\t\t[-realm realm_list | [-clearrealm realm_list]\n"
-            "\t\t[-addrealm realm_list]] service_dn\n"
-
-/* View Service */
-            "view_service    service_dn\n"
-
-/* Destroy Service */
-            "destroy_service [-force] [-f stashfilename] service_dn\n"
-
-/* List services */
-            "list_service    [-basedn base_dn]\n"
-
-/* Set Service password */
-            "setsrvpw        [-randpw|-fileonly] [-f filename] service_dn\n"
-
-#else
+              "list\n"
 
 /* Stash the service password */
-            "stashsrvpw      [-f filename] service_dn\n"
-
-#endif
+              "stashsrvpw      [-f filename] service_dn\n"
 
 /* Create policy */
-            "create_policy   [-r realm] [-maxtktlife max_ticket_life]\n"
-            "\t\t[-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy\n"
+              "create_policy   [-r realm] [-maxtktlife max_ticket_life]\n"
+              "\t\t[-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy\n"
 
 /* Modify policy */
-            "modify_policy   [-r realm] [-maxtktlife max_ticket_life]\n"
-            "\t\t[-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy\n"
+              "modify_policy   [-r realm] [-maxtktlife max_ticket_life]\n"
+              "\t\t[-maxrenewlife max_renewable_ticket_life] [ticket_flags] policy\n"
 
 /* View policy */
-            "view_policy     [-r realm] policy\n"
+              "view_policy     [-r realm] policy\n"
 
 /* Destroy policy */
-            "destroy_policy  [-r realm] [-force] policy\n"
+              "destroy_policy  [-r realm] [-force] policy\n"
 
 /* List policies */
-            "list_policy     [-r realm]\n"
-
-    );
+              "list_policy     [-r realm]\n"));
 }
 
 void
@@ -308,14 +266,14 @@ main(int argc, char *argv[])
     retval = kadm5_init_krb5_context(&util_context);
     set_com_err_hook(extended_com_err_fn);
     if (retval) {
-        com_err (progname, retval, "while initializing Kerberos code");
+        com_err(progname, retval, _("while initializing Kerberos code"));
         exit_status++;
         goto cleanup;
     }
 
     cmd_argv = (char **) malloc(sizeof(char *)*argc);
     if (cmd_argv == NULL) {
-        com_err(progname, ENOMEM, "while creating sub-command arguments");
+        com_err(progname, ENOMEM, _("while creating sub-command arguments"));
         exit_status++;
         goto cleanup;
     }
@@ -338,13 +296,15 @@ main(int argc, char *argv[])
             /* not sure this is really necessary */
             if ((retval = krb5_set_default_realm(util_context,
                                                  global_params.realm))) {
-                com_err(progname, retval, "while setting default realm name");
+                com_err(progname, retval,
+                        _("while setting default realm name"));
                 exit_status++;
                 goto cleanup;
             }
         } else if (strcmp(*argv, "-k") == 0 && ARG_VAL) {
             if (krb5_string_to_enctype(koptarg, &global_params.enctype)) {
-                com_err(progname, EINVAL, ": %s is an invalid enctype", koptarg);
+                com_err(progname, EINVAL,
+                        _(": %s is an invalid enctype"), koptarg);
                 exit_status++;
                 goto cleanup;
             } else
@@ -352,7 +312,8 @@ main(int argc, char *argv[])
         } else if (strcmp(*argv, "-kv") == 0 && ARG_VAL) {
             global_params.kvno = (krb5_kvno) atoi(koptarg);
             if (global_params.kvno == IGNORE_VNO) {
-                com_err(progname, EINVAL, ": %s is an invalid mkeyVNO", koptarg);
+                com_err(progname, EINVAL,
+                        _(": %s is an invalid mkeyVNO"), koptarg);
                 exit_status++;
                 goto cleanup;
             } else
@@ -370,7 +331,7 @@ main(int argc, char *argv[])
         } else if (strcmp(*argv, "-D") == 0 && ARG_VAL) {
             bind_dn = koptarg;
             if (bind_dn == NULL) {
-                com_err(progname, ENOMEM, "while reading ldap parameters");
+                com_err(progname, ENOMEM, _("while reading ldap parameters"));
                 exit_status++;
                 goto cleanup;
             }
@@ -378,7 +339,7 @@ main(int argc, char *argv[])
         } else if (strcmp(*argv, "-w") == 0 && ARG_VAL) {
             passwd = strdup(koptarg);
             if (passwd == NULL) {
-                com_err(progname, ENOMEM, "while reading ldap parameters");
+                com_err(progname, ENOMEM, _("while reading ldap parameters"));
                 exit_status++;
                 goto cleanup;
             }
@@ -386,7 +347,7 @@ main(int argc, char *argv[])
         } else if (strcmp(*argv, "-H") == 0 && ARG_VAL) {
             ldap_server = koptarg;
             if (ldap_server == NULL) {
-                com_err(progname, ENOMEM, "while reading ldap parameters");
+                com_err(progname, ENOMEM, _("while reading ldap parameters"));
                 exit_status++;
                 goto cleanup;
             }
@@ -436,7 +397,7 @@ main(int argc, char *argv[])
         retval = krb5_get_default_realm(util_context, &temp);
         if (retval) {
             if (realm_name_required) {
-                com_err (progname, retval, "while getting default realm");
+                com_err (progname, retval, _("while getting default realm"));
                 exit_status++;
                 goto cleanup;
             }
@@ -475,7 +436,8 @@ main(int argc, char *argv[])
         retval = kadm5_get_config_params(util_context, 1,
                                          &global_params, &global_params);
         if (retval) {
-            com_err(progname, retval, "while retreiving configuration parameters");
+            com_err(progname, retval,
+                    _("while retreiving configuration parameters"));
             exit_status++;
             goto cleanup;
         }
@@ -483,7 +445,7 @@ main(int argc, char *argv[])
     }
 
     if ((retval = krb5_ldap_lib_init()) != 0) {
-        com_err(progname, retval, "while initializing error handling");
+        com_err(progname, retval, _("while initializing error handling"));
         exit_status++;
         goto cleanup;
     }
@@ -491,7 +453,7 @@ main(int argc, char *argv[])
     /* Initialize the ldap context */
     ldap_context = calloc(sizeof(krb5_ldap_context), 1);
     if (ldap_context == NULL) {
-        com_err(progname, ENOMEM, "while initializing ldap handle");
+        com_err(progname, ENOMEM, _("while initializing ldap handle"));
         exit_status++;
         goto cleanup;
     }
@@ -504,7 +466,8 @@ main(int argc, char *argv[])
         if (passwd == NULL) {
             passwd = (char *)malloc(MAX_PASSWD_LEN);
             if (passwd == NULL) {
-                com_err(progname, ENOMEM, "while retrieving ldap configuration");
+                com_err(progname, ENOMEM,
+                        _("while retrieving ldap configuration"));
                 exit_status++;
                 goto cleanup;
             }
@@ -512,18 +475,21 @@ main(int argc, char *argv[])
             if (prompt == NULL) {
                 free(passwd);
                 passwd = NULL;
-                com_err(progname, ENOMEM, "while retrieving ldap configuration");
+                com_err(progname, ENOMEM,
+                        _("while retrieving ldap configuration"));
                 exit_status++;
                 goto cleanup;
             }
             memset(passwd, 0, MAX_PASSWD_LEN);
             passwd_len = MAX_PASSWD_LEN - 1;
-            snprintf(prompt, MAX_PASSWD_PROMPT_LEN, "Password for \"%s\"", bind_dn);
+            snprintf(prompt, MAX_PASSWD_PROMPT_LEN,
+                     _("Password for \"%s\""), bind_dn);
 
             db_retval = krb5_read_password(util_context, prompt, NULL, passwd, &passwd_len);
 
             if ((db_retval) || (passwd_len == 0)) {
-                com_err(progname, ENOMEM, "while retrieving ldap configuration");
+                com_err(progname, ENOMEM,
+                        _("while retrieving ldap configuration"));
                 free(passwd);
                 passwd = NULL;
                 exit_status++;
@@ -540,14 +506,14 @@ main(int argc, char *argv[])
 
         ldap_context->server_info_list = (krb5_ldap_server_info **) calloc (2, sizeof (krb5_ldap_server_info *)) ;
         if (ldap_context->server_info_list == NULL) {
-            com_err(progname, ENOMEM, "while initializing server list");
+            com_err(progname, ENOMEM, _("while initializing server list"));
             exit_status++;
             goto cleanup;
         }
 
         ldap_context->server_info_list[0] = (krb5_ldap_server_info *) calloc (1, sizeof (krb5_ldap_server_info));
         if (ldap_context->server_info_list[0] == NULL) {
-            com_err(progname, ENOMEM, "while initializing server list");
+            com_err(progname, ENOMEM, _("while initializing server list"));
             exit_status++;
             goto cleanup;
         }
@@ -556,7 +522,7 @@ main(int argc, char *argv[])
 
         ldap_context->server_info_list[0]->server_name = strdup(ldap_server);
         if (ldap_context->server_info_list[0]->server_name == NULL) {
-            com_err(progname, ENOMEM, "while initializing server list");
+            com_err(progname, ENOMEM, _("while initializing server list"));
             exit_status++;
             goto cleanup;
         }
@@ -564,7 +530,8 @@ main(int argc, char *argv[])
     if (bind_dn) {
         ldap_context->bind_dn = strdup(bind_dn);
         if (ldap_context->bind_dn == NULL) {
-            com_err(progname, ENOMEM, "while retrieving ldap configuration");
+            com_err(progname, ENOMEM,
+                    _("while retrieving ldap configuration"));
             exit_status++;
             goto cleanup;
         }
@@ -577,7 +544,7 @@ main(int argc, char *argv[])
         if ((global_params.enctype != ENCTYPE_UNKNOWN) &&
             (!krb5_c_valid_enctype(global_params.enctype))) {
             com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP,
-                    "while setting up enctype %d", global_params.enctype);
+                    _("while setting up enctype %d"), global_params.enctype);
         }
     }
 
@@ -586,7 +553,7 @@ main(int argc, char *argv[])
     /* Setup DAL handle to access the database */
     db_retval = krb5_db_setup_lib_handle(util_context);
     if (db_retval) {
-        com_err(progname, db_retval, "while setting up lib handle");
+        com_err(progname, db_retval, _("while setting up lib handle"));
         exit_status++;
         goto cleanup;
     }
@@ -595,7 +562,7 @@ main(int argc, char *argv[])
 
     db_retval = krb5_ldap_read_server_params(util_context, conf_section, KRB5_KDB_SRV_TYPE_OTHER);
     if (db_retval) {
-        com_err(progname, db_retval, "while reading ldap configuration");
+        com_err(progname, db_retval, _("while reading ldap configuration"));
         exit_status++;
         goto cleanup;
     }
@@ -603,7 +570,7 @@ main(int argc, char *argv[])
     if (cmd->opendb) {
         db_retval = krb5_ldap_db_init(util_context, (krb5_ldap_context *)util_context->dal_handle->db_context);
         if (db_retval) {
-            com_err(progname, db_retval, "while initializing database");
+            com_err(progname, db_retval, _("while initializing database"));
             exit_status++;
             goto cleanup;
         }
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
index 7b6bf22163..7811bdb740 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
@@ -108,12 +108,13 @@ krb5_ldap_read_startup_information(krb5_context context)
 
     SETUP_CONTEXT();
     if ((retval=krb5_ldap_read_krbcontainer_params(context, &(ldap_context->krbcontainer)))) {
-        prepend_err_str (context, "Unable to read Kerberos container", retval, retval);
+        prepend_err_str(context, _("Unable to read Kerberos container"),
+                        retval, retval);
         goto cleanup;
     }
 
     if ((retval=krb5_ldap_read_realm_params(context, context->default_realm, &(ldap_context->lrparams), &mask))) {
-        prepend_err_str (context, "Unable to read Realm", retval, retval);
+        prepend_err_str(context, _("Unable to read Realm"), retval, retval);
         goto cleanup;
     }
 
@@ -239,8 +240,8 @@ cleanup:
     return ret;
 }
 
-#define ERR_MSG1 "Unable to check if SASL EXTERNAL mechanism is supported by LDAP server. Proceeding anyway ..."
-#define ERR_MSG2 "SASL EXTERNAL mechanism not supported by LDAP server. Can't perform certificate-based bind."
+#define ERR_MSG1 _("Unable to check if SASL EXTERNAL mechanism is supported by LDAP server. Proceeding anyway ...")
+#define ERR_MSG2 _("SASL EXTERNAL mechanism not supported by LDAP server. Can't perform certificate-based bind.")
 
 /* Function to check if a LDAP server supports the SASL external mechanism
  *Return values:
@@ -322,12 +323,13 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
                 free (opt);
                 free (val);
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'binddn' missing");
+                krb5_set_error_message(context, status, _("'binddn' missing"));
                 goto clean_n_exit;
             }
             if (val == NULL) {
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'binddn' value missing");
+                krb5_set_error_message(context, status,
+                                       _("'binddn' value missing"));
                 free(opt);
                 goto clean_n_exit;
             }
@@ -343,12 +345,13 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
                 free (opt);
                 free (val);
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'nconns' missing");
+                krb5_set_error_message(context, status, _("'nconns' missing"));
                 goto clean_n_exit;
             }
             if (val == NULL) {
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'nconns' value missing");
+                krb5_set_error_message(context, status,
+                                       _("'nconns' value missing"));
                 free(opt);
                 goto clean_n_exit;
             }
@@ -358,12 +361,14 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
                 free (opt);
                 free (val);
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'bindpwd' missing");
+                krb5_set_error_message(context, status,
+                                       _("'bindpwd' missing"));
                 goto clean_n_exit;
             }
             if (val == NULL) {
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'bindpwd' value missing");
+                krb5_set_error_message(context, status,
+                                       _("'bindpwd' value missing"));
                 free(opt);
                 goto clean_n_exit;
             }
@@ -377,7 +382,8 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
         } else if (opt && !strcmp(opt, "host")) {
             if (val == NULL) {
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'host' value missing");
+                krb5_set_error_message(context, status,
+                                       _("'host' value missing"));
                 free(opt);
                 goto clean_n_exit;
             }
@@ -414,7 +420,8 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
         } else if (opt && !strcmp(opt, "cert")) {
             if (val == NULL) {
                 status = EINVAL;
-                krb5_set_error_message (context, status, "'cert' value missing");
+                krb5_set_error_message(context, status,
+                                       _("'cert' value missing"));
                 free(opt);
                 goto clean_n_exit;
             }
@@ -449,10 +456,12 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
                  * temporary is passed in when kdb5_util load without -update is done.
                  * This is unsupported by the LDAP plugin.
                  */
-                krb5_set_error_message (context, status,
-                                        "open of LDAP directory aborted, plugin requires -update argument");
+                krb5_set_error_message(context, status,
+                                       _("open of LDAP directory aborted, "
+                                         "plugin requires -update argument"));
             } else {
-                krb5_set_error_message (context, status, "unknown option \'%s\'",
+                krb5_set_error_message (context, status,
+                                        _("unknown option \'%s\'"),
                                         opt?opt:val);
             }
             free(opt);
@@ -473,7 +482,8 @@ krb5_ldap_open(krb5_context context, char *conf_section, char **db_args,
             krb5_ldap_free_ldap_context(ldap_context);
         ldap_context = NULL;
         dal_handle->db_context = NULL;
-        prepend_err_str (context, "Error reading LDAP server params: ", status, status);
+        prepend_err_str(context, _("Error reading LDAP server params: "),
+                        status, status);
         goto clean_n_exit;
     }
     if ((status=krb5_ldap_db_init(context, ldap_context)) != 0) {
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
index cb23c22a69..5896724391 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
@@ -46,20 +46,22 @@ krb5_validate_ldap_context(krb5_context context,
 
     if (ldap_context->bind_dn == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "LDAP bind dn value missing ");
+        krb5_set_error_message(context, st, _("LDAP bind dn value missing "));
         goto err_out;
     }
 
     if (ldap_context->bind_pwd == NULL && ldap_context->service_password_file == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "LDAP bind password value missing ");
+        krb5_set_error_message(context, st,
+                               _("LDAP bind password value missing "));
         goto err_out;
     }
 
     if (ldap_context->bind_pwd == NULL && ldap_context->service_password_file !=
         NULL && ldap_context->service_cert_path == NULL) {
         if ((st=krb5_ldap_readpassword(context, ldap_context, &password)) != 0) {
-            prepend_err_str(context, "Error reading password from stash: ", st, st);
+            prepend_err_str(context, _("Error reading password from stash: "),
+                            st, st);
             goto err_out;
         }
 
@@ -77,7 +79,8 @@ krb5_validate_ldap_context(krb5_context context,
             ldap_context->bind_pwd = (char *)password;
             if (ldap_context->bind_pwd == NULL) {
                 st = EINVAL;
-                krb5_set_error_message(context, st, "Error reading password from stash");
+                krb5_set_error_message(context, st,
+                                       _("Error reading password from stash"));
                 goto err_out;
             }
         }
@@ -86,7 +89,8 @@ krb5_validate_ldap_context(krb5_context context,
     /* NULL password not allowed */
     if (ldap_context->bind_pwd != NULL && strlen(ldap_context->bind_pwd) == 0) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "Service password length is zero");
+        krb5_set_error_message(context, st,
+                               _("Service password length is zero"));
         goto err_out;
     }
 
@@ -251,8 +255,8 @@ err_out:
     if (sasl_mech_supported == FALSE) {
         st = KRB5_KDB_ACCESS_ERROR;
         krb5_set_error_message (context, st,
-                                "Certificate based authentication requested but "
-                                "not supported by LDAP servers");
+                                _("Certificate based authentication requested "
+                                  "but not supported by LDAP servers"));
     }
     return (st);
 }
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
index 2d7ed170ab..24b442d8fc 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_create.c
@@ -218,11 +218,13 @@ krb5_ldap_create(krb5_context context, char *conf_section, char **db_args)
                  * temporary is passed in when kdb5_util load without -update is done.
                  * This is unsupported by the LDAP plugin.
                  */
-                krb5_set_error_message (context, status,
-                                        "creation of LDAP entries aborted, plugin requires -update argument");
+                krb5_set_error_message(context, status,
+                                       _("creation of LDAP entries aborted, "
+                                         "plugin requires -update argument"));
             } else {
-                krb5_set_error_message (context, status, "unknown option \'%s\'",
-                                        opt?opt:val);
+                krb5_set_error_message(context, status,
+                                       _("unknown option \'%s\'"),
+                                       opt?opt:val);
             }
             free(opt);
             free(val);
@@ -365,7 +367,8 @@ cleanup:
         rc = krb5_ldap_delete_krbcontainer(context,
                                            ((kparams.DN != NULL) ? &kparams : NULL));
         krb5_set_error_message(context, rc,
-                               "could not complete roll-back, error deleting Kerberos Container");
+                               _("could not complete roll-back, error "
+                                 "deleting Kerberos Container"));
     }
 
     /* should call krb5_ldap_free_krbcontainer_params() but can't */
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
index f8b825cb0e..25d5ad4f47 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_krbcontainer.c
@@ -93,8 +93,9 @@ krb5_ldap_read_krbcontainer_params(krb5_context context,
         if ((st=profile_get_string(context->profile, KDB_MODULE_SECTION, ldap_context->conf_section,
                                    "ldap_kerberos_container_dn", NULL,
                                    &cparams->DN)) != 0) {
-            krb5_set_error_message(context, st, "Error reading kerberos container location "
-                                   "from krb5.conf");
+            krb5_set_error_message(context, st,
+                                   _("Error reading kerberos container "
+                                     "location from krb5.conf"));
             goto cleanup;
         }
     }
@@ -104,8 +105,9 @@ krb5_ldap_read_krbcontainer_params(krb5_context context,
         if ((st=profile_get_string(context->profile, KDB_MODULE_DEF_SECTION,
                                    "ldap_kerberos_container_dn", NULL,
                                    NULL, &cparams->DN)) != 0) {
-            krb5_set_error_message(context, st, "Error reading kerberos container location "
-                                   "from krb5.conf");
+            krb5_set_error_message(context, st,
+                                   _("Error reading kerberos container "
+                                     "location from krb5.conf"));
             goto cleanup;
         }
     }
@@ -117,7 +119,8 @@ krb5_ldap_read_krbcontainer_params(krb5_context context,
  */
     if (cparams->DN == NULL) {
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message(context, st, "Kerberos container location not specified");
+        krb5_set_error_message(context, st,
+                               _("Kerberos container location not specified"));
         goto cleanup;
     }
 #endif
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
index 81fe3be9b8..14dec3a60e 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
@@ -84,8 +84,8 @@ prof_get_integer_def(krb5_context ctx, const char *conf_section,
                                KDB_MODULE_SECTION, conf_section, name,
                                0, &out_temp);
     if (err) {
-        krb5_set_error_message (ctx, err, "Error reading '%s' attribute: %s",
-                                name, error_message(err));
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
+                               name, error_message(err));
         return err;
     }
     if (out_temp != 0) {
@@ -96,8 +96,8 @@ prof_get_integer_def(krb5_context ctx, const char *conf_section,
                                KDB_MODULE_DEF_SECTION, name, 0,
                                dfl, &out_temp);
     if (err) {
-        krb5_set_error_message (ctx, err, "Error reading '%s' attribute: %s",
-                                name, error_message(err));
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
+                               name, error_message(err));
         return err;
     }
     *out = out_temp;
@@ -116,7 +116,7 @@ prof_get_boolean_def(krb5_context ctx, const char *conf_section,
     err = profile_get_boolean(ctx->profile, KDB_MODULE_SECTION, conf_section,
                               name, -1, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, "Error reading '%s' attribute: %s",
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
                                name, error_message(err));
         return err;
     }
@@ -127,7 +127,7 @@ prof_get_boolean_def(krb5_context ctx, const char *conf_section,
     err = profile_get_boolean(ctx->profile, KDB_MODULE_DEF_SECTION, name, 0,
                               dfl, &out_temp);
     if (err) {
-        krb5_set_error_message(ctx, err, "Error reading '%s' attribute: %s",
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
                                name, error_message(err));
         return err;
     }
@@ -147,8 +147,8 @@ prof_get_string_def(krb5_context ctx, const char *conf_section,
                               KDB_MODULE_SECTION, conf_section, name,
                               0, out);
     if (err) {
-        krb5_set_error_message (ctx, err, "Error reading '%s' attribute: %s",
-                                name, error_message(err));
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
+                               name, error_message(err));
         return err;
     }
     if (*out != 0)
@@ -157,8 +157,8 @@ prof_get_string_def(krb5_context ctx, const char *conf_section,
                               KDB_MODULE_DEF_SECTION, name, 0,
                               0, out);
     if (err) {
-        krb5_set_error_message (ctx, err, "Error reading '%s' attribute: %s",
-                                name, error_message(err));
+        krb5_set_error_message(ctx, err, _("Error reading '%s' attribute: %s"),
+                               name, error_message(err));
         return err;
     }
     return 0;
@@ -224,8 +224,8 @@ krb5_ldap_read_server_params(krb5_context context, char *conf_section,
 
     if (ldap_context->max_server_conns < 2) {
         st = EINVAL;
-        krb5_set_error_message (context, st,
-                                "Minimum connections required per server is 2");
+        krb5_set_error_message(context, st, _("Minimum connections required "
+                                              "per server is 2"));
         goto cleanup;
     }
 
@@ -299,7 +299,8 @@ krb5_ldap_read_server_params(krb5_context context, char *conf_section,
 
         if ((st=profile_get_string(context->profile, KDB_MODULE_SECTION, conf_section,
                                    KRB5_CONF_LDAP_SERVERS, NULL, &tempval)) != 0) {
-            krb5_set_error_message (context, st, "Error reading 'ldap_servers' attribute");
+            krb5_set_error_message(context, st, _("Error reading "
+                                                  "'ldap_servers' attribute"));
             goto cleanup;
         }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
index 1b4c5d5cb0..54dfbdb670 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal.c
@@ -160,7 +160,7 @@ krb5_ldap_iterate(krb5_context context, char *match_expr,
         realm = context->default_realm;
         if (realm == NULL) {
             st = EINVAL;
-            krb5_set_error_message(context, st, "Default realm not set");
+            krb5_set_error_message(context, st, _("Default realm not set"));
             goto cleanup;
         }
     }
@@ -260,7 +260,7 @@ krb5_ldap_delete_principal(krb5_context context,
 
     if (DN == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "DN information missing");
+        krb5_set_error_message(context, st, _("DN information missing"));
         goto cleanup;
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index cbff516425..8fe4fb2c35 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -104,7 +104,8 @@ krb5_ldap_get_principal(krb5_context context, krb5_const_principal searchfor,
     CHECK_LDAP_HANDLE(ldap_context);
 
     if (is_principal_in_realm(ldap_context, searchfor) != 0) {
-        krb5_set_error_message (context, st, "Principal does not belong to realm");
+        krb5_set_error_message(context, st,
+                               _("Principal does not belong to realm"));
         goto cleanup;
     }
 
@@ -259,7 +260,6 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
 {
     int                   i=0;
     krb5_error_code       st=0;
-    char                  errbuf[1024];
     char                  *arg=NULL, *arg_val=NULL;
     char                  **dptr=NULL;
     unsigned int          arg_val_len=0;
@@ -275,9 +275,9 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
                         xargs->dn != NULL || xargs->containerdn != NULL ||
                         xargs->linkdn != NULL) {
                         st = EINVAL;
-                        snprintf(errbuf, sizeof(errbuf),
-                                 "%s option not supported", arg);
-                        krb5_set_error_message(context, st, "%s", errbuf);
+                        krb5_set_error_message(context, st,
+                                               _("%s option not supported"),
+                                               arg);
                         goto cleanup;
                     }
                     dptr = &xargs->dn;
@@ -285,43 +285,41 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
                     if (optype == MODIFY_PRINCIPAL ||
                         xargs->dn != NULL || xargs->containerdn != NULL) {
                         st = EINVAL;
-                        snprintf(errbuf, sizeof(errbuf),
-                                 "%s option not supported", arg);
-                        krb5_set_error_message(context, st, "%s", errbuf);
+                        krb5_set_error_message(context, st,
+                                               _("%s option not supported"),
+                                               arg);
                         goto cleanup;
                     }
                     dptr = &xargs->containerdn;
                 } else if (strcmp(arg, LINKDN_ARG) == 0) {
                     if (xargs->dn != NULL || xargs->linkdn != NULL) {
                         st = EINVAL;
-                        snprintf(errbuf, sizeof(errbuf),
-                                 "%s option not supported", arg);
-                        krb5_set_error_message(context, st, "%s", errbuf);
+                        krb5_set_error_message(context, st,
+                                               _("%s option not supported"),
+                                               arg);
                         goto cleanup;
                     }
                     dptr = &xargs->linkdn;
                 } else {
                     st = EINVAL;
-                    snprintf(errbuf, sizeof(errbuf), "unknown option: %s", arg);
-                    krb5_set_error_message(context, st, "%s", errbuf);
+                    krb5_set_error_message(context, st,
+                                           _("unknown option: %s"), arg);
                     goto cleanup;
                 }
 
                 xargs->dn_from_kbd = TRUE;
                 if (arg_val == NULL || strlen(arg_val) == 0) {
                     st = EINVAL;
-                    snprintf(errbuf, sizeof(errbuf),
-                             "%s option value missing", arg);
-                    krb5_set_error_message(context, st, "%s", errbuf);
+                    krb5_set_error_message(context, st,
+                                           _("%s option value missing"), arg);
                     goto cleanup;
                 }
             }
 
             if (arg_val == NULL) {
                 st = EINVAL;
-                snprintf(errbuf, sizeof(errbuf),
-                         "%s option value missing", arg);
-                krb5_set_error_message(context, st, "%s", errbuf);
+                krb5_set_error_message(context, st,
+                                       _("%s option value missing"), arg);
                 goto cleanup;
             }
             arg_val_len = strlen(arg_val) + 1;
@@ -515,7 +513,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
     if (is_principal_in_realm(ldap_context, entry->princ) != 0) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "Principal does not belong to the default realm");
+        krb5_set_error_message(context, st, _("Principal does not belong to "
+                                              "the default realm"));
         goto cleanup;
     }
 
@@ -557,7 +556,9 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
         if (user == NULL) {
             /* must have principal name for search */
             st = EINVAL;
-            krb5_set_error_message(context, st, "operation can not continue, principal name not found");
+            krb5_set_error_message(context, st,
+                                   _("operation can not continue, principal "
+                                     "name not found"));
             goto cleanup;
         }
         princlen = strlen(FILTER) + strlen(user) + 2 + 1;      /* 2 for closing brackets */
@@ -588,7 +589,9 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                     free(filter);
                     st = EINVAL;
                     krb5_set_error_message(context, st,
-                                           "operation can not continue, more than one entry with principal name \"%s\" found",
+                                           _("operation can not continue, "
+                                             "more than one entry with "
+                                             "principal name \"%s\" found"),
                                            user);
                     goto cleanup;
                 } else if (numlentries == 1) {
@@ -651,7 +654,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
                 if (st == KRB5_KDB_NOENTRY || st == KRB5_KDB_CONSTRAINT_VIOLATION) {
                     int ost = st;
                     st = EINVAL;
-                    snprintf(errbuf, sizeof(errbuf), "'%s' not found: ",
+                    snprintf(errbuf, sizeof(errbuf), _("'%s' not found: "),
                              xargs.containerdn);
                     prepend_err_str(context, errbuf, st, ost);
                 }
@@ -731,7 +734,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
         if (outofsubtree == TRUE) {
             st = EINVAL;
-            krb5_set_error_message(context, st, "DN is out of the realm subtree");
+            krb5_set_error_message(context, st,
+                                   _("DN is out of the realm subtree"));
             goto cleanup;
         }
 
@@ -785,7 +789,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
     if (xargs.dn != NULL && krb_identity_exists == TRUE) {
         st = EINVAL;
-        snprintf(errbuf, sizeof(errbuf), "ldap object is already kerberized");
+        snprintf(errbuf, sizeof(errbuf),
+                 _("ldap object is already kerberized"));
         krb5_set_error_message(context, st, "%s", errbuf);
         goto cleanup;
     }
@@ -805,7 +810,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             kerberos_principal_object_type != KDB_STANDALONE_PRINCIPAL_OBJECT) {
             st = EINVAL;
             snprintf(errbuf, sizeof(errbuf),
-                     "link information can not be set/updated as the kerberos principal belongs to an ldap object");
+                     _("link information can not be set/updated as the "
+                       "kerberos principal belongs to an ldap object"));
             krb5_set_error_message(context, st, "%s", errbuf);
             goto cleanup;
         }
@@ -819,15 +825,15 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
             if ((st=krb5_get_linkdn(context, entry, &linkdns)) != 0) {
                 snprintf(errbuf, sizeof(errbuf),
-                         "Failed getting object references");
+                         _("Failed getting object references"));
                 krb5_set_error_message(context, st, "%s", errbuf);
                 goto cleanup;
             }
             if (linkdns != NULL) {
                 st = EINVAL;
                 snprintf(errbuf, sizeof(errbuf),
-                         "kerberos principal is already linked "
-                         "to a ldap object");
+                         _("kerberos principal is already linked to a ldap "
+                           "object"));
                 krb5_set_error_message(context, st, "%s", errbuf);
                 for (j=0; linkdns[j] != NULL; ++j)
                     free (linkdns[j]);
@@ -1134,7 +1140,7 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
 
         if (strlen(xargs.tktpolicydn) != 0) {
             st = checkattributevalue(ld, xargs.tktpolicydn, "objectclass", policyclass, &tmask);
-            CHECK_CLASS_VALIDITY(st, tmask, "ticket policy object value: ");
+            CHECK_CLASS_VALIDITY(st, tmask, _("ticket policy object value: "));
 
             strval[0] = xargs.tktpolicydn;
             strval[1] = NULL;
@@ -1181,8 +1187,9 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             /* a load operation must replace an existing entry */
             st = ldap_delete_ext_s(ld, standalone_principal_dn, NULL, NULL);
             if (st != LDAP_SUCCESS) {
-                snprintf(errbuf, sizeof(errbuf), "Principal delete failed (trying to replace entry): %s",
-                         ldap_err2string(st));
+                snprintf(errbuf, sizeof(errbuf),
+                         _("Principal delete failed (trying to replace "
+                           "entry): %s"), ldap_err2string(st));
                 st = translate_ldap_error (st, OP_ADD);
                 krb5_set_error_message(context, st, "%s", errbuf);
                 goto cleanup;
@@ -1191,7 +1198,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             }
         }
         if (st != LDAP_SUCCESS) {
-            snprintf(errbuf, sizeof(errbuf), "Principal add failed: %s", ldap_err2string(st));
+            snprintf(errbuf, sizeof(errbuf), _("Principal add failed: %s"),
+                     ldap_err2string(st));
             st = translate_ldap_error (st, OP_ADD);
             krb5_set_error_message(context, st, "%s", errbuf);
             goto cleanup;
@@ -1228,7 +1236,8 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
             st = ldap_modify_ext_s(ld, principal_dn, mods, NULL, NULL);
 
         if (st != LDAP_SUCCESS) {
-            snprintf(errbuf, sizeof(errbuf), "User modification failed: %s", ldap_err2string(st));
+            snprintf(errbuf, sizeof(errbuf), _("User modification failed: %s"),
+                     ldap_err2string(st));
             st = translate_ldap_error (st, OP_MOD);
             krb5_set_error_message(context, st, "%s", errbuf);
             goto cleanup;
@@ -1291,7 +1300,8 @@ krb5_read_tkt_policy(krb5_context context, krb5_ldap_context *ldap_context,
     if (policy != NULL) {
         st = krb5_ldap_read_policy(context, policy, &tktpoldnparam, &omask);
         if (st && st != KRB5_KDB_NOENTRY) {
-            prepend_err_str(context, "Error reading ticket policy. ", st, st);
+            prepend_err_str(context, _("Error reading ticket policy. "), st,
+                            st);
             goto cleanup;
         }
 
@@ -1355,8 +1365,9 @@ krb5_decode_krbsecretkey(krb5_context context, krb5_db_entry *entries,
         if (st != 0) {
             const char *msg = error_message(st);
             st = -1; /* Something more appropriate ? */
-            krb5_set_error_message (context, st,
-                                    "unable to decode stored principal key data (%s)", msg);
+            krb5_set_error_message(context, st, _("unable to decode stored "
+                                                  "principal key data (%s)"),
+                                   msg);
             goto cleanup;
         }
         noofkeys += n_kd;
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c
index d994b430c7..77a8bd8769 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c
@@ -76,7 +76,8 @@ krb5_ldap_create_password_policy(krb5_context context, osa_policy_ent_t policy)
     rdns = ldap_explode_dn(policy_dn, 1);
     if (rdns == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "Invalid password policy DN syntax");
+        krb5_set_error_message(context, st,
+                               _("Invalid password policy DN syntax"));
         goto cleanup;
     }
 
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
index 145af10dc7..9ab7a0398e 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_realm.c
@@ -267,7 +267,8 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
 
     if (lrealm == NULL) {
         st = EINVAL;
-        krb5_set_error_message (context, st, "Realm information not available");
+        krb5_set_error_message(context, st,
+                               _("Realm information not available"));
         goto cleanup;
     }
 
@@ -339,7 +340,8 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
     /* Delete all ticket policies */
     {
         if ((st = krb5_ldap_list_policy (context, ldap_context->lrparams->realmdn, &policy)) != 0) {
-            prepend_err_str (context, "Error reading ticket policy: ", st, st);
+            prepend_err_str(context, _("Error reading ticket policy: "), st,
+                            st);
             goto cleanup;
         }
 
@@ -351,8 +353,8 @@ krb5_ldap_delete_realm (krb5_context context, char *lrealm)
     if ((st=ldap_delete_ext_s(ld, ldap_context->lrparams->realmdn, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_DEL);
-        krb5_set_error_message (context, st, "Realm Delete FAILED: %s",
-                                ldap_err2string(ost));
+        krb5_set_error_message(context, st, _("Realm Delete FAILED: %s"),
+                               ldap_err2string(ost));
     }
 
 cleanup:
@@ -441,7 +443,7 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             free (voidptr);
         } else {
             st = EINVAL;
-            krb5_set_error_message (context, st, "tl_data not available");
+            krb5_set_error_message(context, st, _("tl_data not available"));
             return st;
         }
     }
@@ -455,7 +457,7 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
                 if (strlen(rparams->subtree[k]) != 0) {
                     st = checkattributevalue(ld, rparams->subtree[k], "Objectclass", subtreeclass,
                                              &objectmask);
-                    CHECK_CLASS_VALIDITY(st, objectmask, "subtree value: ");
+                    CHECK_CLASS_VALIDITY(st, objectmask, _("subtree value: "));
                 }
             }
             strval = rparams->subtree;
@@ -471,7 +473,8 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         if (strlen(rparams->containerref) != 0 ) {
             st = checkattributevalue(ld, rparams->containerref, "Objectclass", subtreeclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "container reference value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("container reference value: "));
             strvalprc[0] = rparams->containerref;
             strvalprc[1] = NULL;
             if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbPrincContainerRef", LDAP_MOD_REPLACE,
@@ -523,7 +526,8 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         for (i=0; rparams->kdcservers[i] != NULL; ++i) {
             st = checkattributevalue(ld, rparams->kdcservers[i], "objectClass", kdcclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "kdc service object value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("kdc service object value: "));
         }
 
         if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbkdcservers", LDAP_MOD_REPLACE,
@@ -537,7 +541,8 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         for (i=0; rparams->adminservers[i] != NULL; ++i) {
             st = checkattributevalue(ld, rparams->adminservers[i], "objectClass", adminclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "admin service object value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("admin service object value: "));
         }
 
         if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbadmservers", LDAP_MOD_REPLACE,
@@ -551,7 +556,8 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         for (i=0; rparams->passwdservers[i] != NULL; ++i) {
             st = checkattributevalue(ld, rparams->passwdservers[i], "objectClass", pwdclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "password service object value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("password service object value: "));
         }
 
         if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbpwdservers", LDAP_MOD_REPLACE,
@@ -638,9 +644,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; oldkdcservers[i]; ++i)
                 if ((st=deleteAttribute(ld, oldkdcservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf (errbuf, sizeof(errbuf), "Error removing 'krbRealmReferences' from %s: ",
-                              oldkdcservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error removing 'krbRealmReferences' from "
+                               "%s: "), oldkdcservers[i]);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
 
@@ -649,9 +656,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; newkdcservers[i]; ++i)
                 if ((st=updateAttribute(ld, newkdcservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf (errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
-                              newkdcservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error adding 'krbRealmReferences' to %s: "),
+                             newkdcservers[i]);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
 
@@ -675,9 +683,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; oldadminservers[i]; ++i)
                 if ((st=deleteAttribute(ld, oldadminservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf(errbuf, sizeof(errbuf), "Error removing 'krbRealmReferences' from "
-                             "%s: ", oldadminservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error removing 'krbRealmReferences' from "
+                               "%s: "), oldadminservers[i]);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
 
@@ -686,9 +695,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; newadminservers[i]; ++i)
                 if ((st=updateAttribute(ld, newadminservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf(errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error adding 'krbRealmReferences' to %s: "),
                              newadminservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
         if (newadminservers)
@@ -711,9 +721,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; oldpasswdservers[i]; ++i)
                 if ((st=deleteAttribute(ld, oldpasswdservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf(errbuf, sizeof(errbuf), "Error removing 'krbRealmReferences' from "
-                             "%s: ", oldpasswdservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error removing 'krbRealmReferences' from "
+                               "%s: "), oldpasswdservers[i]);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
 
@@ -722,9 +733,10 @@ krb5_ldap_modify_realm(krb5_context context, krb5_ldap_realm_params *rparams,
             for (i=0; newpasswdservers[i]; ++i)
                 if ((st=updateAttribute(ld, newpasswdservers[i], "krbRealmReferences",
                                         rparams->realmdn)) != 0) {
-                    snprintf(errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
+                    snprintf(errbuf, sizeof(errbuf),
+                             _("Error adding 'krbRealmReferences' to %s: "),
                              newpasswdservers[i]);
-                    prepend_err_str (context, errbuf, st, st);
+                    prepend_err_str(context, errbuf, st, st);
                     goto cleanup;
                 }
         if (newpasswdservers)
@@ -795,7 +807,8 @@ krb5_ldap_create_krbcontainer(krb5_context context,
         kerberoscontdn = KERBEROS_CONTAINER;
 #else
         st = EINVAL;
-        krb5_set_error_message (context, st, "Kerberos Container information is missing");
+        krb5_set_error_message(context, st,
+                               _("Kerberos Container information is missing"));
         goto cleanup;
 #endif
     }
@@ -808,7 +821,8 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     rdns = ldap_explode_dn(kerberoscontdn, 1);
     if (rdns == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "Invalid Kerberos container DN");
+        krb5_set_error_message(context, st,
+                               _("Invalid Kerberos container DN"));
         goto cleanup;
     }
 
@@ -821,7 +835,7 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     if (krbcontparams && krbcontparams->policyreference) {
         st = checkattributevalue(ld, krbcontparams->policyreference, "objectclass", policyclass,
                                  &pmask);
-        CHECK_CLASS_VALIDITY(st, pmask, "ticket policy object value: ");
+        CHECK_CLASS_VALIDITY(st, pmask, _("ticket policy object value: "));
 
         strval[0] = krbcontparams->policyreference;
         strval[1] = NULL;
@@ -834,7 +848,9 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     if ((st = ldap_add_ext_s(ld, kerberoscontdn, mods, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
-        krb5_set_error_message (context, st, "Kerberos Container create FAILED: %s", ldap_err2string(ost));
+        krb5_set_error_message(context, st,
+                               _("Kerberos Container create FAILED: %s"),
+                               ldap_err2string(ost));
         goto cleanup;
     }
 
@@ -847,7 +863,8 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     /* check whether the security container is bound to krbcontainerrefaux object class */
     if ((st=checkattributevalue(ld, SECURITY_CONTAINER, "objectClass",
                                 krbContainerRefclass, &crmask)) != 0) {
-        prepend_err_str (context, "Security Container read FAILED: ", st, st);
+        prepend_err_str(context, _("Security Container read FAILED: "), st,
+                        st);
         /* delete Kerberos Container, status ignored intentionally */
         ldap_delete_ext_s(ld, kerberoscontdn, NULL, NULL);
         goto cleanup;
@@ -869,7 +886,9 @@ krb5_ldap_create_krbcontainer(krb5_context context,
     if ((st=ldap_modify_ext_s(ld, SECURITY_CONTAINER, mods, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_MOD);
-        krb5_set_error_message (context, st, "Security Container update FAILED: %s", ldap_err2string(ost));
+        krb5_set_error_message(context, st,
+                               _("Security Container update FAILED: %s"),
+                               ldap_err2string(ost));
         /* delete Kerberos Container, status ignored intentionally */
         ldap_delete_ext_s(ld, kerberoscontdn, NULL, NULL);
         goto cleanup;
@@ -915,7 +934,8 @@ krb5_ldap_delete_krbcontainer(krb5_context context,
         kerberoscontdn = KERBEROS_CONTAINER;
 #else
         st = EINVAL;
-        krb5_set_error_message (context, st, "Kerberos Container information is missing");
+        krb5_set_error_message(context, st,
+                               _("Kerberos Container information is missing"));
         goto cleanup;
 #endif
     }
@@ -924,7 +944,9 @@ krb5_ldap_delete_krbcontainer(krb5_context context,
     if ((st = ldap_delete_ext_s(ld, kerberoscontdn, NULL, NULL)) != LDAP_SUCCESS) {
         int ost = st;
         st = translate_ldap_error (st, OP_ADD);
-        krb5_set_error_message (context, st, "Kerberos Container delete FAILED: %s", ldap_err2string(ost));
+        krb5_set_error_message(context, st,
+                               _("Kerberos Container delete FAILED: %s"),
+                               ldap_err2string(ost));
         goto cleanup;
     }
 
@@ -1015,7 +1037,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
                 if (strlen(rparams->subtree[i]) != 0) {
                     st = checkattributevalue(ld, rparams->subtree[i], "Objectclass", subtreeclass,
                                              &objectmask);
-                    CHECK_CLASS_VALIDITY(st, objectmask, "realm object value: ");
+                    CHECK_CLASS_VALIDITY(st, objectmask,
+                                         _("realm object value: "));
                 }
             }
             if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbsubtrees", LDAP_MOD_ADD,
@@ -1081,7 +1104,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         for (i=0; rparams->kdcservers[i] != NULL; ++i) {
             st = checkattributevalue(ld, rparams->kdcservers[i], "objectClass", kdcclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "kdc service object value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("kdc service object value: "));
 
         }
 
@@ -1096,7 +1120,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
         for (i=0; rparams->adminservers[i] != NULL; ++i) {
             st = checkattributevalue(ld, rparams->adminservers[i], "objectClass", adminclass,
                                      &objectmask);
-            CHECK_CLASS_VALIDITY(st, objectmask, "admin service object value: ");
+            CHECK_CLASS_VALIDITY(st, objectmask,
+                                 _("admin service object value: "));
 
         }
 
@@ -1131,7 +1156,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
     if (mask & LDAP_REALM_KDCSERVERS)
         for (i=0; rparams->kdcservers[i]; ++i)
             if ((st=updateAttribute(ld, rparams->kdcservers[i], "krbRealmReferences", dn)) != 0) {
-                snprintf(errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
+                snprintf(errbuf, sizeof(errbuf),
+                         _("Error adding 'krbRealmReferences' to %s: "),
                          rparams->kdcservers[i]);
                 prepend_err_str (context, errbuf, st, st);
                 /* delete Realm, status ignored intentionally */
@@ -1142,7 +1168,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
     if (mask & LDAP_REALM_ADMINSERVERS)
         for (i=0; rparams->adminservers[i]; ++i)
             if ((st=updateAttribute(ld, rparams->adminservers[i], "krbRealmReferences", dn)) != 0) {
-                snprintf(errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
+                snprintf(errbuf, sizeof(errbuf),
+                         _("Error adding 'krbRealmReferences' to %s: "),
                          rparams->adminservers[i]);
                 prepend_err_str (context, errbuf, st, st);
                 /* delete Realm, status ignored intentionally */
@@ -1153,7 +1180,8 @@ krb5_ldap_create_realm(krb5_context context, krb5_ldap_realm_params *rparams,
     if (mask & LDAP_REALM_PASSWDSERVERS)
         for (i=0; rparams->passwdservers[i]; ++i)
             if ((st=updateAttribute(ld, rparams->passwdservers[i], "krbRealmReferences", dn)) != 0) {
-                snprintf(errbuf, sizeof(errbuf), "Error adding 'krbRealmReferences' to %s: ",
+                snprintf(errbuf, sizeof(errbuf),
+                         _("Error adding 'krbRealmReferences' to %s: "),
                          rparams->passwdservers[i]);
                 prepend_err_str (context, errbuf, st, st);
                 /* delete Realm, status ignored intentionally */
@@ -1363,7 +1391,9 @@ krb5_ldap_read_realm_params(krb5_context context, char *lrealm,
         if (st != LDAP_SUCCESS && st != LDAP_NO_SUCH_OBJECT) {
             int ost = st;
             st = translate_ldap_error (st, OP_SEARCH);
-            krb5_set_error_message (context, st, "Policy object read failed: %s", ldap_err2string(ost));
+            krb5_set_error_message(context, st,
+                                   _("Policy object read failed: %s"),
+                                   ldap_err2string(ost));
             goto cleanup;
         }
         ent = ldap_first_entry (ld, result);
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
index fa28b973c0..7eb325b34a 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_service_stash.c
@@ -100,7 +100,8 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
 
     if (entryfound == 0)  {
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message (context, st, "Bind DN entry missing in stash file");
+        krb5_set_error_message(context, st,
+                               _("Bind DN entry missing in stash file"));
         goto rp_exit;
     }
     /* replace the \n with \0 */
@@ -112,7 +113,7 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
     if (start == NULL) {
         /* password field missing */
         st = KRB5_KDB_SERVER_INTERNAL_ERR;
-        krb5_set_error_message (context, st, "Stash file entry corrupt");
+        krb5_set_error_message(context, st, _("Stash file entry corrupt"));
         goto rp_exit;
     }
     ++ start;
@@ -145,15 +146,18 @@ krb5_ldap_readpassword(krb5_context context, krb5_ldap_context *ldap_context,
                     break;
                 case ERR_PWD_ZERO:
                     st = EINVAL;
-                    krb5_set_error_message(context, st, "Password has zero length");
+                    krb5_set_error_message(context, st,
+                                           _("Password has zero length"));
                     break;
                 case ERR_PWD_BAD:
                     st = EINVAL;
-                    krb5_set_error_message(context, st, "Password corrupted");
+                    krb5_set_error_message(context, st,
+                                           _("Password corrupted"));
                     break;
                 case ERR_PWD_NOT_HEX:
                     st = EINVAL;
-                    krb5_set_error_message(context, st, "Not a hexadecimal password");
+                    krb5_set_error_message(context, st,
+                                           _("Not a hexadecimal password"));
                     break;
                 default:
                     st = KRB5_KDB_SERVER_INTERNAL_ERR;
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_services.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_services.c
index 2e9fc31baa..13abd0d6ec 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_services.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_services.c
@@ -107,7 +107,8 @@ krb5_ldap_create_service(krb5_context context,
                 goto cleanup;
         } else {
             st = EINVAL;
-            krb5_set_error_message (context, st, "'krbhostserver' argument invalid");
+            krb5_set_error_message(context, st,
+                                   _("'krbhostserver' argument invalid"));
             goto cleanup;
         }
     }
@@ -120,14 +121,15 @@ krb5_ldap_create_service(krb5_context context,
             for (j=0; service->krbrealmreferences[j] != NULL; ++j) {
                 st = checkattributevalue(ld, service->krbrealmreferences[j], "ObjectClass",
                                          realmcontclass, &realmmask);
-                CHECK_CLASS_VALIDITY(st, realmmask, "realm object value: ");
+                CHECK_CLASS_VALIDITY(st, realmmask, _("realm object value: "));
             }
             if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbrealmreferences", LDAP_MOD_ADD,
                                               service->krbrealmreferences)) != 0)
                 goto cleanup;
         } else {
             st = EINVAL;
-            krb5_set_error_message (context, st, "Server has no 'krbrealmreferences'");
+            krb5_set_error_message(context, st,
+                                   _("Server has no 'krbrealmreferences'"));
             goto cleanup;
         }
     }
@@ -146,10 +148,10 @@ krb5_ldap_create_service(krb5_context context,
         for (i=0; service->krbrealmreferences[i]; ++i) {
             if ((st=updateAttribute(ld, service->krbrealmreferences[i], realmattr,
                                     service->servicedn)) != 0) {
-                snprintf (errbuf, sizeof(errbuf),
-                          "Error adding 'krbRealmReferences' to %s: ",
-                          service->krbrealmreferences[i]);
-                prepend_err_str (context, errbuf, st, st);
+                snprintf(errbuf, sizeof(errbuf),
+                         _("Error adding 'krbRealmReferences' to %s: "),
+                         service->krbrealmreferences[i]);
+                prepend_err_str(context, errbuf, st, st);
                 /* delete service object, status ignored intentionally */
                 ldap_delete_ext_s(ld, service->servicedn, NULL, NULL);
                 goto cleanup;
@@ -191,7 +193,7 @@ krb5_ldap_modify_service(krb5_context context,
     /* validate the input parameter */
     if (service == NULL || service->servicedn == NULL) {
         st = EINVAL;
-        krb5_set_error_message (context, st, "Service DN is NULL");
+        krb5_set_error_message(context, st, _("Service DN is NULL"));
         goto cleanup;
     }
 
@@ -224,7 +226,7 @@ krb5_ldap_modify_service(krb5_context context,
             for (j=0; service->krbrealmreferences[j]; ++j) {
                 st = checkattributevalue(ld, service->krbrealmreferences[j], "ObjectClass",
                                          realmcontclass, &realmmask);
-                CHECK_CLASS_VALIDITY(st, realmmask, "realm object value: ");
+                CHECK_CLASS_VALIDITY(st, realmmask, _("realm object value: "));
             }
             if ((st=krb5_add_str_mem_ldap_mod(&mods, "krbrealmreferences", LDAP_MOD_REPLACE,
                                               service->krbrealmreferences)) != 0)
@@ -269,7 +271,8 @@ krb5_ldap_modify_service(krb5_context context,
             ldap_msgfree(result);
         } else {
             st = EINVAL;
-            krb5_set_error_message (context, st, "'krbRealmReferences' value invalid");
+            krb5_set_error_message(context, st,
+                                   _("'krbRealmReferences' value invalid"));
             goto cleanup;
         }
     }
@@ -304,7 +307,9 @@ krb5_ldap_modify_service(krb5_context context,
             /* update the dn represented by the attribute that is to be deleted */
             for (i=0; oldrealmrefs[i]; ++i)
                 if ((st=deleteAttribute(ld, oldrealmrefs[i], realmattr, service->servicedn)) != 0) {
-                    prepend_err_str (context, "Error deleting realm attribute:", st, st);
+                    prepend_err_str(context,
+                                    _("Error deleting realm attribute:"), st,
+                                    st);
                     goto cleanup;
                 }
         }
@@ -312,7 +317,8 @@ krb5_ldap_modify_service(krb5_context context,
         /* see if some of the attributes have to be added */
         for (i=0; newrealmrefs[i]; ++i)
             if ((st=updateAttribute(ld, newrealmrefs[i], realmattr, service->servicedn)) != 0) {
-                prepend_err_str (context, "Error updating realm attribute: ", st, st);
+                prepend_err_str(context, _("Error updating realm attribute: "),
+                                st, st);
                 goto cleanup;
             }
     }
@@ -420,7 +426,7 @@ krb5_ldap_read_service(krb5_context context, char *servicedn,
     /* validate the input parameter */
     if (servicedn == NULL) {
         st = EINVAL;
-        krb5_set_error_message (context, st, "Service DN NULL");
+        krb5_set_error_message(context, st, _("Service DN NULL"));
         goto cleanup;
     }
 
@@ -431,7 +437,7 @@ krb5_ldap_read_service(krb5_context context, char *servicedn,
 
     /* the policydn object should be of the krbService object class */
     st = checkattributevalue(ld, servicedn, "objectClass", attrvalues, &objectmask);
-    CHECK_CLASS_VALIDITY(st, objectmask, "service object value: ");
+    CHECK_CLASS_VALIDITY(st, objectmask, _("service object value: "));
 
     /* Initialize service structure */
     lservice =(krb5_ldap_service_params *) calloc(1, sizeof(krb5_ldap_service_params));
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
index 40483f6090..99b54017ef 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_tkt_policy.c
@@ -53,7 +53,7 @@ krb5_ldap_create_policy(krb5_context context, krb5_ldap_policy_params *policy,
     /* validate the input parameters */
     if (policy == NULL || policy->policy == NULL) {
         st = EINVAL;
-        krb5_set_error_message (context, st, "Ticket Policy Name missing");
+        krb5_set_error_message(context, st, _("Ticket Policy Name missing"));
         goto cleanup;
     }
 
@@ -129,7 +129,7 @@ krb5_ldap_modify_policy(krb5_context context, krb5_ldap_policy_params *policy,
     /* validate the input parameters */
     if (policy == NULL || policy->policy==NULL) {
         st = EINVAL;
-        krb5_set_error_message (context, st, "Ticket Policy Name missing");
+        krb5_set_error_message(context, st, _("Ticket Policy Name missing"));
         goto cleanup;
     }
 
@@ -141,7 +141,7 @@ krb5_ldap_modify_policy(krb5_context context, krb5_ldap_policy_params *policy,
 
     /* the policydn object should be of the krbTicketPolicy object class */
     st = checkattributevalue(ld, policy_dn, "objectClass", attrvalues, &objectmask);
-    CHECK_CLASS_VALIDITY(st, objectmask, "ticket policy object: ");
+    CHECK_CLASS_VALIDITY(st, objectmask, _("ticket policy object: "));
 
     if ((objectmask & 0x02) == 0) { /* add krbticketpolicyaux to the object class list */
         memset(strval, 0, sizeof(strval));
@@ -206,7 +206,8 @@ krb5_ldap_read_policy(krb5_context context, char *policyname,
     /* validate the input parameters */
     if (policyname == NULL  || policy == NULL) {
         st = EINVAL;
-        krb5_set_error_message(context, st, "Ticket Policy Object information missing");
+        krb5_set_error_message(context, st,
+                               _("Ticket Policy Object information missing"));
         goto cleanup;
     }
 
@@ -218,7 +219,7 @@ krb5_ldap_read_policy(krb5_context context, char *policyname,
 
     /* the policydn object should be of the krbTicketPolicy object class */
     st = checkattributevalue(ld, policy_dn, "objectClass", attrvalues, &objectmask);
-    CHECK_CLASS_VALIDITY(st, objectmask, "ticket policy object: ");
+    CHECK_CLASS_VALIDITY(st, objectmask, _("ticket policy object: "));
 
     /* Initialize ticket policy structure */
     lpolicy =(krb5_ldap_policy_params *) malloc(sizeof(krb5_ldap_policy_params));
@@ -293,7 +294,7 @@ krb5_ldap_delete_policy(krb5_context context, char *policyname)
 
     if (policyname == NULL) {
         st = EINVAL;
-        prepend_err_str (context,"Ticket Policy Object DN missing",st,st);
+        prepend_err_str(context, _("Ticket Policy Object DN missing"), st, st);
         goto cleanup;
     }
 
@@ -319,7 +320,9 @@ krb5_ldap_delete_policy(krb5_context context, char *policyname)
         }
     } else {
         st = EINVAL;
-        prepend_err_str (context,"Delete Failed: One or more Principals associated with the Ticket Policy",st,st);
+        prepend_err_str(context,
+                        _("Delete Failed: One or more Principals associated "
+                          "with the Ticket Policy"), st, st);
         goto cleanup;
     }
 
@@ -426,7 +429,8 @@ krb5_ldap_list(krb5_context context, char ***list, char *objectclass,
     /* check if the containerdn exists */
     if (containerdn) {
         if ((st=checkattributevalue(ld, containerdn, NULL, NULL, NULL)) != 0) {
-            prepend_err_str (context, "Error reading container object: ", st, st);
+            prepend_err_str(context, _("Error reading container object: "),
+                            st, st);
             goto cleanup;
         }
     }
diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
index 65984824e3..b7246a99f9 100644
--- a/src/plugins/preauth/pkinit/pkinit.h
+++ b/src/plugins/preauth/pkinit/pkinit.h
@@ -33,6 +33,7 @@
 
 #include <krb5/krb5.h>
 #include <krb5/preauth_plugin.h>
+#include <k5-platform.h>
 #include <k5-int-pkinit.h>
 #include <profile.h>
 #include "pkinit_accessor.h"
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index e5a3e34cc7..51c0ee1d0c 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -856,8 +856,8 @@ cms_signeddata_create(krb5_context context,
     ASN1_OBJECT *oid = NULL;
 
     if (id_cryptoctx->my_certs == NULL) {
-        krb5_set_error_message(context, EINVAL, "cms_signdata_create called "
-                               "with no certificates");
+        krb5_set_error_message(context, EINVAL, _("cms_signdata_create called "
+                                                  "with no certificates"));
         return EINVAL;
     }
     /* Start creating PKCS7 data. */
@@ -1211,9 +1211,9 @@ cms_signeddata_verify(krb5_context context,
         octets = CMS_get0_content(cms);
         if (!octets || ((*octets)->type != V_ASN1_OCTET_STRING)) {
             retval = KRB5KDC_ERR_PREAUTH_FAILED;
-            krb5_set_error_message(context, KRB5KDC_ERR_PREAUTH_FAILED,
-                                   "Invalid pkinit packet: octet string "
-                                   "expected");
+            krb5_set_error_message(context, retval,
+                                   _("Invalid pkinit packet: octet string "
+                                     "expected"));
             goto cleanup;
         }
         *data_len = ASN1_STRING_length(*octets);
@@ -1231,7 +1231,7 @@ cms_signeddata_verify(krb5_context context,
         if (OBJ_obj2nid(type) != NID_pkcs7_signed) {
             pkiDebug("Expected id-signedData CMS msg (received type = %d)\n",
                      OBJ_obj2nid(type));
-            krb5_set_error_message(context, retval, "wrong oid\n");
+            krb5_set_error_message(context, retval, _("wrong oid\n"));
             goto cleanup;
         }
     }
@@ -3912,7 +3912,7 @@ pkinit_get_certs_pkcs12(krb5_context context,
         int r = 0;
         char prompt_string[128];
         char prompt_reply[128];
-        char prompt_prefix[] = "Pass phrase for";
+        char *prompt_prefix = _("Pass phrase for");
 
         pkiDebug("Initial PKCS12_parse with no password failed\n");
 
@@ -5764,6 +5764,6 @@ pkinit_pkcs11_code_to_text(int err)
             break;
     if (pkcs11_errstrings[i].text != NULL)
         return (pkcs11_errstrings[i].text);
-    snprintf(uc, sizeof(uc), "unknown code 0x%x", err);
+    snprintf(uc, sizeof(uc), _("unknown code 0x%x"), err);
     return (uc);
 }
diff --git a/src/plugins/preauth/pkinit/pkinit_identity.c b/src/plugins/preauth/pkinit/pkinit_identity.c
index 2ba05a470d..2527753f43 100644
--- a/src/plugins/preauth/pkinit/pkinit_identity.c
+++ b/src/plugins/preauth/pkinit/pkinit_identity.c
@@ -415,8 +415,8 @@ process_option_identity(krb5_context context,
             pkiDebug("%s: Unsupported type while processing '%s'\n",
                      __FUNCTION__, value);
             krb5_set_error_message(context, KRB5_PREAUTH_FAILED,
-                                   "Unsupported type while processing '%s'\n",
-                                   value);
+                                   _("Unsupported type while processing "
+                                     "'%s'\n"), value);
             return KRB5_PREAUTH_FAILED;
         }
     } else {
@@ -449,7 +449,8 @@ process_option_identity(krb5_context context,
         break;
     default:
         krb5_set_error_message(context, KRB5_PREAUTH_FAILED,
-                               "Internal error parsing X509_user_identity\n");
+                               _("Internal error parsing "
+                                 "X509_user_identity\n"));
         retval = EINVAL;
         break;
     }
diff --git a/src/plugins/preauth/pkinit/pkinit_srv.c b/src/plugins/preauth/pkinit/pkinit_srv.c
index 5a7a5adfe5..2a33e93311 100644
--- a/src/plugins/preauth/pkinit/pkinit_srv.c
+++ b/src/plugins/preauth/pkinit/pkinit_srv.c
@@ -425,8 +425,9 @@ pkinit_server_verify_padata(krb5_context context,
         if (!krb5_principal_compare(context, request->client,
                                     krb5_anonymous_principal())) {
             retval = KRB5KDC_ERR_PREAUTH_FAILED;
-            krb5_set_error_message(context, retval, "Pkinit request not "
-                                   "signed, but client not anonymous.");
+            krb5_set_error_message(context, retval,
+                                   _("Pkinit request not signed, but client "
+                                     "not anonymous."));
             goto cleanup;
         }
     }
@@ -457,7 +458,9 @@ pkinit_server_verify_padata(krb5_context context,
         } else if (!is_signed) {
             /*Anonymous pkinit requires DH*/
             retval = KRB5KDC_ERR_PREAUTH_FAILED;
-            krb5_set_error_message(context, retval, "Anonymous pkinit without DH public value not supported.");
+            krb5_set_error_message(context, retval,
+                                   _("Anonymous pkinit without DH public "
+                                     "value not supported."));
             goto cleanup;
         }
         /*
@@ -1087,7 +1090,7 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
     if (retval != 0 || NULL == plgctx->idopts->identity) {
         retval = EINVAL;
         krb5_set_error_message(context, retval,
-                               "No pkinit_identity supplied for realm %s",
+                               _("No pkinit_identity supplied for realm %s"),
                                plgctx->realmname);
         goto errout;
     }
@@ -1098,7 +1101,7 @@ pkinit_init_kdc_profile(krb5_context context, pkinit_kdc_context plgctx)
     if (retval != 0 || NULL == plgctx->idopts->anchors) {
         retval = EINVAL;
         krb5_set_error_message(context, retval,
-                               "No pkinit_anchors supplied for realm %s",
+                               _("No pkinit_anchors supplied for realm %s"),
                                plgctx->realmname);
         goto errout;
     }
@@ -1280,8 +1283,9 @@ pkinit_server_plugin_init(krb5_context context, void **blob,
 
     if (j == 0) {
         retval = EINVAL;
-        krb5_set_error_message(context, retval, "No realms configured "
-                               "correctly for pkinit support");
+        krb5_set_error_message(context, retval,
+                               _("No realms configured correctly for pkinit "
+                                 "support"));
         goto errout;
     }
 
diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index 771249faca..bf3edd4d39 100644
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: mit-krb5 1.10-prerelease\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2011-06-06 12:34-0400\n"
+"POT-Creation-Date: 2011-06-06 13:43-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff --git a/src/slave/kprop.c b/src/slave/kprop.c
index f14f67bca3..1aa78773b1 100644
--- a/src/slave/kprop.c
+++ b/src/slave/kprop.c
@@ -80,8 +80,8 @@ void    update_last_prop_file(char *, char *);
 
 static void usage()
 {
-    fprintf(stderr, "\nUsage: %s [-r realm] [-f file] [-d] [-P port] [-s srvtab] slave_host\n\n",
-            progname);
+    fprintf(stderr, _("\nUsage: %s [-r realm] [-f file] [-d] [-P port] "
+                      "[-s srvtab] slave_host\n\n"), progname);
     exit(1);
 }
 
@@ -98,7 +98,7 @@ main(argc, argv)
 
     retval = krb5_init_context(&context);
     if (retval) {
-        com_err(argv[0], retval, "while initializing krb5");
+        com_err(argv[0], retval, _("while initializing krb5"));
         exit(1);
     }
     PRS(argc, argv);
@@ -111,7 +111,7 @@ main(argc, argv)
     xmit_database(context, auth_context, my_creds, fd, database_fd,
                   database_size);
     update_last_prop_file(slave_host, file);
-    printf("Database propagation to %s: SUCCEEDED\n", slave_host);
+    printf(_("Database propagation to %s: SUCCEEDED\n"), slave_host);
     krb5_free_cred_contents(context, my_creds);
     close_database(context, database_fd);
     exit(0);
@@ -195,13 +195,14 @@ void get_tickets(context)
     retval = krb5_sname_to_principal(context, NULL, NULL,
                                      KRB5_NT_SRV_HST, &my_principal);
     if (retval) {
-        com_err(progname, errno, "while setting client principal name");
+        com_err(progname, errno, _("while setting client principal name"));
         exit(1);
     }
     if (realm) {
         retval = krb5_set_principal_realm(context, my_principal, realm);
         if (retval) {
-            com_err(progname, errno, "while setting client principal realm");
+            com_err(progname, errno,
+                    _("while setting client principal realm"));
             exit(1);
         }
     } else if (krb5_is_referral_realm(krb5_princ_realm(context,
@@ -210,12 +211,13 @@ void get_tickets(context)
          * referral realm.  Use the default realm instead. */
         retval = krb5_get_default_realm(context, &def_realm);
         if (retval) {
-            com_err(progname, errno, "while getting default realm");
+            com_err(progname, errno, _("while getting default realm"));
             exit(1);
         }
         retval = krb5_set_principal_realm(context, my_principal, def_realm);
         if (retval) {
-            com_err(progname, errno, "while setting client principal realm");
+            com_err(progname, errno,
+                    _("while setting client principal realm"));
             exit(1);
         }
     }
@@ -232,15 +234,13 @@ void get_tickets(context)
 
     retval = krb5_cc_resolve(context, buf, &ccache);
     if (retval) {
-        com_err(progname, retval, "while opening credential cache %s",
-                buf);
+        com_err(progname, retval, _("while opening credential cache %s"), buf);
         exit(1);
     }
 
     retval = krb5_cc_initialize(context, ccache, my_principal);
     if (retval) {
-        com_err (progname, retval, "when initializing cache %s",
-                 buf);
+        com_err(progname, retval, _("when initializing cache %s"), buf);
         exit(1);
     }
 
@@ -254,7 +254,7 @@ void get_tickets(context)
                                      slave_host, KPROP_SERVICE_NAME,
                                      KRB5_NT_SRV_HST, &creds.server);
     if (retval) {
-        com_err(progname, errno, "while setting server principal name");
+        com_err(progname, errno, _("while setting server principal name"));
         (void) krb5_cc_destroy(context, ccache);
         exit(1);
     }
@@ -262,7 +262,7 @@ void get_tickets(context)
         retval = krb5_set_principal_realm(context, creds.server, realm);
         if (retval) {
             com_err(progname, errno,
-                    "while setting server principal realm");
+                    _("while setting server principal realm"));
             exit(1);
         }
     }
@@ -272,14 +272,14 @@ void get_tickets(context)
      */
     retval = krb5_copy_principal(context, my_principal, &creds.client);
     if (retval) {
-        com_err(progname, retval, "While copying client principal");
+        com_err(progname, retval, _("while copying client principal"));
         (void) krb5_cc_destroy(context, ccache);
         exit(1);
     }
     if (srvtab) {
         retval = krb5_kt_resolve(context, srvtab, &keytab);
         if (retval) {
-            com_err(progname, retval, "while resolving keytab");
+            com_err(progname, retval, _("while resolving keytab"));
             (void) krb5_cc_destroy(context, ccache);
             exit(1);
         }
@@ -288,7 +288,7 @@ void get_tickets(context)
     retval = krb5_get_in_tkt_with_keytab(context, 0, 0, NULL,
                                          NULL, keytab, ccache, &creds, 0);
     if (retval) {
-        com_err(progname, retval, "while getting initial ticket\n");
+        com_err(progname, retval, _("while getting initial ticket\n"));
         (void) krb5_cc_destroy(context, ccache);
         exit(1);
     }
@@ -302,7 +302,7 @@ void get_tickets(context)
      */
     retval = krb5_cc_destroy(context, ccache);
     if (retval) {
-        com_err(progname, retval, "while destroying ticket cache");
+        com_err(progname, retval, _("while destroying ticket cache"));
         exit(1);
     }
 }
@@ -332,7 +332,7 @@ open_connection(krb5_context context, char *host, int *fd)
     for (res = answers; res != NULL; res = res->ai_next) {
         s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
         if (s < 0) {
-            com_err(progname, errno, "while creating socket");
+            com_err(progname, errno, _("while creating socket"));
             exit(1);
         }
 
@@ -348,7 +348,7 @@ open_connection(krb5_context context, char *host, int *fd)
         retval = sockaddr2krbaddr(context, res->ai_family, res->ai_addr,
                                   &receiver_addr);
         if (retval != 0) {
-            com_err(progname, retval, "while converting server address");
+            com_err(progname, retval, _("while converting server address"));
             exit(1);
         }
 
@@ -358,19 +358,19 @@ open_connection(krb5_context context, char *host, int *fd)
     freeaddrinfo(answers);
 
     if (s == -1) {
-        com_err(progname, retval, "while connecting to server");
+        com_err(progname, retval, _("while connecting to server"));
         exit(1);
     }
 
     /* Set sender_addr. */
     socket_length = sizeof(my_sin);
     if (getsockname(s, (struct sockaddr *)&my_sin, &socket_length) < 0) {
-        com_err(progname, errno, "while getting local socket address");
+        com_err(progname, errno, _("while getting local socket address"));
         exit(1);
     }
     sa = (struct sockaddr *) &my_sin;
     if (sockaddr2krbaddr(context, sa->sa_family, sa, &sender_addr) != 0) {
-        com_err(progname, errno, "while converting local address");
+        com_err(progname, errno, _("while converting local address"));
         exit(1);
     }
 }
@@ -397,7 +397,7 @@ void kerberos_authenticate(context, auth_context, fd, me, new_creds)
     retval = krb5_auth_con_setaddrs(context, *auth_context, sender_addr,
                                     receiver_addr);
     if (retval) {
-        com_err(progname, retval, "in krb5_auth_con_setaddrs");
+        com_err(progname, retval, _("in krb5_auth_con_setaddrs"));
         exit(1);
     }
 
@@ -406,21 +406,21 @@ void kerberos_authenticate(context, auth_context, fd, me, new_creds)
                            AP_OPTS_MUTUAL_REQUIRED, NULL, &creds, NULL,
                            &error, &rep_result, new_creds);
     if (retval) {
-        com_err(progname, retval, "while authenticating to server");
+        com_err(progname, retval, _("while authenticating to server"));
         if (error) {
             if (error->error == KRB_ERR_GENERIC) {
-                if (error->text.data)
-                    fprintf(stderr,
-                            "Generic remote error: %s\n",
+                if (error->text.data) {
+                    fprintf(stderr, _("Generic remote error: %s\n"),
                             error->text.data);
+                }
             } else if (error->error) {
                 com_err(progname,
                         (krb5_error_code) error->error + ERROR_TABLE_BASE_krb5,
-                        "signalled from server");
-                if (error->text.data)
-                    fprintf(stderr,
-                            "Error text from server: %s\n",
+                        _("signalled from server"));
+                if (error->text.data) {
+                    fprintf(stderr, _("Error text from server: %s\n"),
                             error->text.data);
+                }
             }
             krb5_free_error(context, error);
         }
@@ -452,12 +452,12 @@ open_database(context, data_fn, size)
 
     dbpathname = strdup(data_fn);
     if (!dbpathname) {
-        com_err(progname, ENOMEM, "allocating database file name '%s'",
+        com_err(progname, ENOMEM, _("allocating database file name '%s'"),
                 data_fn);
         exit(1);
     }
     if ((fd = open(dbpathname, O_RDONLY)) < 0) {
-        com_err(progname, errno, "while trying to open %s",
+        com_err(progname, errno, _("while trying to open %s"),
                 dbpathname);
         exit(1);
     }
@@ -465,29 +465,27 @@ open_database(context, data_fn, size)
     err = krb5_lock_file(context, fd,
                          KRB5_LOCKMODE_SHARED|KRB5_LOCKMODE_DONTBLOCK);
     if (err == EAGAIN || err == EWOULDBLOCK || errno == EACCES) {
-        com_err(progname, 0, "database locked");
+        com_err(progname, 0, _("database locked"));
         exit(1);
     } else if (err) {
-        com_err(progname, err, "while trying to lock '%s'", dbpathname);
+        com_err(progname, err, _("while trying to lock '%s'"), dbpathname);
         exit(1);
     }
     if (fstat(fd, &stbuf)) {
-        com_err(progname, errno, "while trying to stat %s",
-                data_fn);
+        com_err(progname, errno, _("while trying to stat %s"), data_fn);
         exit(1);
     }
     if (asprintf(&data_ok_fn, "%s%s", data_fn, ok) < 0) {
-        com_err(progname, ENOMEM, "while trying to malloc data_ok_fn");
+        com_err(progname, ENOMEM, _("while trying to malloc data_ok_fn"));
         exit(1);
     }
     if (stat(data_ok_fn, &stbuf_ok)) {
-        com_err(progname, errno, "while trying to stat %s",
-                data_ok_fn);
+        com_err(progname, errno, _("while trying to stat %s"), data_ok_fn);
         free(data_ok_fn);
         exit(1);
     }
     if (stbuf.st_mtime > stbuf_ok.st_mtime) {
-        com_err(progname, 0, "'%s' more recent than '%s'.",
+        com_err(progname, 0, _("'%s' more recent than '%s'."),
                 data_fn, data_ok_fn);
         exit(1);
     }
@@ -504,7 +502,7 @@ close_database(context, fd)
     int err;
     err = krb5_lock_file(context, fd, KRB5_LOCKMODE_UNLOCK);
     if (err)
-        com_err(progname, err, "while unlocking database '%s'", dbpathname);
+        com_err(progname, err, _("while unlocking database '%s'"), dbpathname);
     free(dbpathname);
     (void)close(fd);
     return;
@@ -548,15 +546,16 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
     retval = krb5_mk_safe(context, auth_context, &inbuf,
                           &outbuf, NULL);
     if (retval) {
-        com_err(progname, retval, "while encoding database size");
-        send_error(context, my_creds, fd, "while encoding database size", retval);
+        com_err(progname, retval, _("while encoding database size"));
+        send_error(context, my_creds, fd, _("while encoding database size"),
+                   retval);
         exit(1);
     }
 
     retval = krb5_write_message(context, (void *) &fd, &outbuf);
     if (retval) {
         krb5_free_data_contents(context, &outbuf);
-        com_err(progname, retval, "while sending database size");
+        com_err(progname, retval, _("while sending database size"));
         exit(1);
     }
     krb5_free_data_contents(context, &outbuf);
@@ -567,7 +566,7 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
     if (retval) {
         send_error(context, my_creds, fd,
                    "failed while initializing i_vector", retval);
-        com_err(progname, retval, "while allocating i_vector");
+        com_err(progname, retval, _("while allocating i_vector"));
         exit(1);
     }
 
@@ -593,7 +592,7 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
         if (retval) {
             krb5_free_data_contents(context, &outbuf);
             com_err(progname, retval,
-                    "while sending database block starting at %d",
+                    _("while sending database block starting at %d"),
                     sent_size);
             exit(1);
         }
@@ -603,7 +602,7 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
             printf("%d bytes sent.\n", sent_size);
     }
     if (sent_size != database_size) {
-        com_err(progname, 0, "Premature EOF found for database file!");
+        com_err(progname, 0, _("Premature EOF found for database file!"));
         send_error(context, my_creds, fd,"Premature EOF found for database file!",
                    KRB5KRB_ERR_GENERIC);
         exit(1);
@@ -615,8 +614,7 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
      */
     retval = krb5_read_message(context, (void *) &fd, &inbuf);
     if (retval) {
-        com_err(progname, retval,
-                "while reading response from server");
+        com_err(progname, retval, _("while reading response from server"));
         exit(1);
     }
     /*
@@ -627,23 +625,23 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
         retval = krb5_rd_error(context, &inbuf, &error);
         if (retval) {
             com_err(progname, retval,
-                    "while decoding error response from server");
+                    _("while decoding error response from server"));
             exit(1);
         }
         if (error->error == KRB_ERR_GENERIC) {
-            if (error->text.data)
-                fprintf(stderr,
-                        "Generic remote error: %s\n",
+            if (error->text.data) {
+                fprintf(stderr, _("Generic remote error: %s\n"),
                         error->text.data);
+            }
         } else if (error->error) {
             com_err(progname,
                     (krb5_error_code) error->error +
                     ERROR_TABLE_BASE_krb5,
-                    "signalled from server");
-            if (error->text.data)
-                fprintf(stderr,
-                        "Error text from server: %s\n",
+                    _("signalled from server"));
+            if (error->text.data) {
+                fprintf(stderr, _("Error text from server: %s\n"),
                         error->text.data);
+            }
         }
         krb5_free_error(context, error);
         exit(1);
@@ -660,7 +658,7 @@ xmit_database(context, auth_context, my_creds, fd, database_fd,
     send_size = ntohl(send_size);
     if (send_size != database_size) {
         com_err(progname, 0,
-                "Kpropd sent database size %d, expecting %d",
+                _("Kpropd sent database size %d, expecting %d"),
                 send_size, database_size);
         exit(1);
     }
@@ -714,12 +712,11 @@ void update_last_prop_file(hostname, file_name)
     if (asprintf(&file_last_prop, "%s.%s%s", file_name, hostname,
                  last_prop) < 0) {
         com_err(progname, ENOMEM,
-                "while allocating filename for update_last_prop_file");
+                _("while allocating filename for update_last_prop_file"));
         return;
     }
     if ((fd = THREEPARAMOPEN(file_last_prop, O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
-        com_err(progname, errno,
-                "while creating 'last_prop' file, '%s'",
+        com_err(progname, errno, _("while creating 'last_prop' file, '%s'"),
                 file_last_prop);
         free(file_last_prop);
         return;
diff --git a/src/slave/kpropd.c b/src/slave/kpropd.c
index 896e8f6486..58486bb28d 100644
--- a/src/slave/kpropd.c
+++ b/src/slave/kpropd.c
@@ -173,10 +173,10 @@ kadm5_get_kiprop_host_srv_name(krb5_context context,
 static void usage()
 {
     fprintf(stderr,
-            "\nUsage: %s [-r realm] [-s srvtab] [-dS] [-f slave_file]\n",
+            _("\nUsage: %s [-r realm] [-s srvtab] [-dS] [-f slave_file]\n"),
             progname);
-    fprintf(stderr, "\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n");
-    fprintf(stderr, "\t[-x db_args]* [-P port] [-a acl_file]\n");
+    fprintf(stderr, _("\t[-F kerberos_db_file ] [-p kdb5_util_pathname]\n"));
+    fprintf(stderr, _("\t[-x db_args]* [-P port] [-a acl_file]\n"));
     exit(1);
 }
 
@@ -275,19 +275,19 @@ retry:
 
     error = get_wildcard_addr(&res);
     if (error != 0) {
-        (void) fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(error));
+        (void) fprintf(stderr, _("getaddrinfo: %s\n"), gai_strerror(error));
         exit(1);
     }
 
     finet = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
     if (finet < 0) {
-        com_err(progname, errno, "while obtaining socket");
+        com_err(progname, errno, _("while obtaining socket"));
         exit(1);
     }
 
     val = 1;
     if (setsockopt(finet, SOL_SOCKET, SO_REUSEADDR, &val, sizeof(val)) < 0)
-        com_err(progname, errno, "while setting SO_REUSEADDR option");
+        com_err(progname, errno, _("while setting SO_REUSEADDR option"));
 
 #if defined(KRB5_USE_INET6) && defined(IPV6_V6ONLY)
     /* Make sure dual-stack support is enabled on IPv6 listener sockets if
@@ -295,7 +295,7 @@ retry:
     val = 0;
     if (res->ai_family == AF_INET6 &&
         setsockopt(finet, IPPROTO_IPV6, IPV6_V6ONLY, &val, sizeof(val)) < 0)
-        com_err(progname, errno, "while unsetting IPV6_V6ONLY option");
+        com_err(progname, errno, _("while unsetting IPV6_V6ONLY option"));
 #endif
 
     /*
@@ -331,7 +331,7 @@ retry:
         backoff_timer *= 2;
     }
     if ((ret = bind(finet, res->ai_addr, res->ai_addrlen)) < 0) {
-        com_err(progname, errno, "while binding listener socket");
+        com_err(progname, errno, _("while binding listener socket"));
         exit(1);
     }
     if (!debug && iproprole != IPROP_SLAVE)
@@ -342,7 +342,7 @@ retry:
         fclose(pidfile);
     } else
         com_err(progname, errno,
-                "while opening pid file %s for writing", PID_FILE);
+                _("while opening pid file %s for writing"), PID_FILE);
 #endif
     if (listen(finet, 5) < 0) {
         com_err(progname, errno, "in listen call");
@@ -355,7 +355,7 @@ retry:
         memset(&frominet, 0, sizeof(frominet));
         fromlen = sizeof(frominet);
         if (debug)
-            fprintf(stderr, "waiting for a kprop connection\n");
+            fprintf(stderr, _("waiting for a kprop connection\n"));
         s = accept(finet, (struct sockaddr *) &frominet, &fromlen);
 
         if (s < 0) {
@@ -389,7 +389,7 @@ retry:
             child_pid = fork();
         switch (child_pid) {
         case -1:
-            com_err(progname, errno, "while forking");
+            com_err(progname, errno, _("while forking"));
             exit(1);
         case 0:
             (void) close(finet);
@@ -461,8 +461,9 @@ void doit(fd)
 #ifdef ENOTSOCK
         if (errno == ENOTSOCK && fd == 0 && !standalone) {
             fprintf(stderr,
-                    "%s: Standard input does not appear to be a network socket.\n"
-                    "\t(Not run from inetd, and missing the -S option?)\n",
+                    _("%s: Standard input does not appear to be a network "
+                      "socket.\n"
+                      "\t(Not run from inetd, and missing the -S option?)\n"),
                     progname);
             exit(1);
         }
@@ -474,12 +475,12 @@ void doit(fd)
     if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (caddr_t) &on,
                    sizeof (on)) < 0) {
         com_err(progname, errno,
-                "while attempting setsockopt (SO_KEEPALIVE)");
+                _("while attempting setsockopt (SO_KEEPALIVE)"));
     }
 
     if (getnameinfo((const struct sockaddr *) &from, fromlen,
                     host, sizeof(host), NULL, 0, 0) == 0) {
-        syslog(LOG_INFO, "Connection from %s", host);
+        syslog(LOG_INFO, _("Connection from %s"), host);
         if (debug)
             printf("Connection from %s\n", host);
     }
@@ -504,12 +505,13 @@ void doit(fd)
                     "While unparsing client name");
             exit(1);
         }
-        if (debug)
+        if (debug) {
             fprintf(stderr,
-                    "Rejected connection from unauthorized principal %s\n",
+                    _("Rejected connection from unauthorized principal %s\n"),
                     name);
+        }
         syslog(LOG_WARNING,
-               "Rejected connection from unauthorized principal %s",
+               _("Rejected connection from unauthorized principal %s"),
                name);
         free(name);
         exit(1);
@@ -520,33 +522,32 @@ void doit(fd)
     retval = krb5_lock_file(kpropd_context, lock_fd,
                             KRB5_LOCKMODE_EXCLUSIVE|KRB5_LOCKMODE_DONTBLOCK);
     if (retval) {
-        com_err(progname, retval, "while trying to lock '%s'",
+        com_err(progname, retval, _("while trying to lock '%s'"),
                 temp_file_name);
         exit(1);
     }
     if ((database_fd = open(temp_file_name,
                             O_WRONLY|O_CREAT|O_TRUNC, 0600)) < 0) {
-        com_err(progname, errno,
-                "while opening database file, '%s'",
+        com_err(progname, errno, _("while opening database file, '%s'"),
                 temp_file_name);
         exit(1);
     }
     recv_database(kpropd_context, fd, database_fd, &confmsg);
     if (rename(temp_file_name, file)) {
-        com_err(progname, errno, "While renaming %s to %s",
+        com_err(progname, errno, _("while renaming %s to %s"),
                 temp_file_name, file);
         exit(1);
     }
     retval = krb5_lock_file(kpropd_context, lock_fd, KRB5_LOCKMODE_SHARED);
     if (retval) {
-        com_err(progname, retval, "while downgrading lock on '%s'",
+        com_err(progname, retval, _("while downgrading lock on '%s'"),
                 temp_file_name);
         exit(1);
     }
     load_database(kpropd_context, kdb5_util, file);
     retval = krb5_lock_file(kpropd_context, lock_fd, KRB5_LOCKMODE_UNLOCK);
     if (retval) {
-        com_err(progname, retval, "while unlocking '%s'", temp_file_name);
+        com_err(progname, retval, _("while unlocking '%s'"), temp_file_name);
         exit(1);
     }
     (void)close(lock_fd);
@@ -558,14 +559,13 @@ void doit(fd)
     retval = krb5_write_message(kpropd_context, (void *) &fd, &confmsg);
     if (retval) {
         krb5_free_data_contents(kpropd_context, &confmsg);
-        com_err(progname, retval,
-                "while sending # of received bytes");
+        com_err(progname, retval, _("while sending # of received bytes"));
         exit(1);
     }
     krb5_free_data_contents(kpropd_context, &confmsg);
     if (close(fd) < 0) {
         com_err(progname, errno,
-                "while trying to close database file");
+                _("while trying to close database file"));
         exit(1);
     }
 
@@ -782,7 +782,7 @@ reinit:
         incr_ret = iprop_get_updates_1(&mylast, handle->clnt);
         if (incr_ret == (kdb_incr_result_t *)NULL) {
             clnt_perror(handle->clnt,
-                        "iprop_get_updates call failed");
+                        _("iprop_get_updates call failed"));
             if (server_handle)
                 kadm5_destroy((void *)server_handle);
             server_handle = (void *)NULL;
@@ -806,7 +806,7 @@ reinit:
                 if (full_ret == (kdb_fullresync_result_t *)
                     NULL) {
                     clnt_perror(handle->clnt,
-                                "iprop_full_resync call failed");
+                                _("iprop_full_resync call failed"));
                     if (server_handle)
                         kadm5_destroy((void *)
                                       server_handle);
@@ -1037,7 +1037,7 @@ void PRS(argv)
      * profile. */
     retval = krb5int_init_context_kdc(&kpropd_context);
     if (retval) {
-        com_err(argv[0], retval, "while initializing krb5");
+        com_err(argv[0], retval, _("while initializing krb5"));
         exit(1);
     }
 
@@ -1130,7 +1130,7 @@ void PRS(argv)
                     new_db_args = realloc(db_args,
                                           (db_args_size+2)*sizeof(*db_args));
                     if (new_db_args == NULL) {
-                        com_err(argv[0], errno, "copying db args");
+                        com_err(argv[0], errno, _("copying db args"));
                         exit(1);
                     }
                     db_args = new_db_args;
@@ -1169,14 +1169,14 @@ void PRS(argv)
                                      KRB5_NT_SRV_HST, &server);
     if (retval) {
         com_err(progname, retval,
-                "While trying to construct my service name");
+                _("while trying to construct my service name"));
         exit(1);
     }
     if (realm) {
         retval = krb5_set_principal_realm(kpropd_context, server, realm);
         if (retval) {
             com_err(progname, errno,
-                    "while constructing my service realm");
+                    _("while constructing my service realm"));
             exit(1);
         }
     }
@@ -1185,7 +1185,7 @@ void PRS(argv)
      */
     if (asprintf(&temp_file_name, "%s%s", file, tmp) < 0) {
         com_err(progname, ENOMEM,
-                "while allocating filename for temp file");
+                _("while allocating filename for temp file"));
         exit(1);
     }
 
@@ -1234,7 +1234,7 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
 
     sin_length = sizeof(r_sin);
     if (getsockname(fd, (struct sockaddr *) &r_sin, &sin_length)) {
-        com_err(progname, errno, "while getting local socket address");
+        com_err(progname, errno, _("while getting local socket address"));
         exit(1);
     }
 
@@ -1246,7 +1246,7 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
 
         retval = krb5_unparse_name(context, server, &name);
         if (retval) {
-            com_err(progname, retval, "While unparsing client name");
+            com_err(progname, retval, _("while unparsing client name"));
             exit(1);
         }
         printf("krb5_recvauth(%d, %s, %s, ...)\n", fd, kprop_version, name);
@@ -1255,7 +1255,7 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
 
     retval = krb5_auth_con_init(context, &auth_context);
     if (retval) {
-        syslog(LOG_ERR, "Error in krb5_auth_con_ini: %s",
+        syslog(LOG_ERR, _("Error in krb5_auth_con_ini: %s"),
                error_message(retval));
         exit(1);
     }
@@ -1263,7 +1263,7 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
     retval = krb5_auth_con_setflags(context, auth_context,
                                     KRB5_AUTH_CONTEXT_DO_SEQUENCE);
     if (retval) {
-        syslog(LOG_ERR, "Error in krb5_auth_con_setflags: %s",
+        syslog(LOG_ERR, _("Error in krb5_auth_con_setflags: %s"),
                error_message(retval));
         exit(1);
     }
@@ -1271,7 +1271,7 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
     retval = krb5_auth_con_setaddrs(context, auth_context, receiver_addr,
                                     sender_addr);
     if (retval) {
-        syslog(LOG_ERR, "Error in krb5_auth_con_setaddrs: %s",
+        syslog(LOG_ERR, _("Error in krb5_auth_con_setaddrs: %s"),
                error_message(retval));
         exit(1);
     }
@@ -1279,7 +1279,8 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
     if (srvtab) {
         retval = krb5_kt_resolve(context, srvtab, &keytab);
         if (retval) {
-            syslog(LOG_ERR, "Error in krb5_kt_resolve: %s", error_message(retval));
+            syslog(LOG_ERR, _("Error in krb5_kt_resolve: %s"),
+                   error_message(retval));
             exit(1);
         }
     }
@@ -1287,13 +1288,14 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
     retval = krb5_recvauth(context, &auth_context, (void *) &fd,
                            kprop_version, server, 0, keytab, &ticket);
     if (retval) {
-        syslog(LOG_ERR, "Error in krb5_recvauth: %s", error_message(retval));
+        syslog(LOG_ERR, _("Error in krb5_recvauth: %s"),
+               error_message(retval));
         exit(1);
     }
 
     retval = krb5_copy_principal(context, ticket->enc_part2->client, clientp);
     if (retval) {
-        syslog(LOG_ERR, "Error in krb5_copy_prinicpal: %s",
+        syslog(LOG_ERR, _("Error in krb5_copy_prinicpal: %s"),
                error_message(retval));
         exit(1);
     }
@@ -1306,17 +1308,17 @@ kerberos_authenticate(context, fd, clientp, etype, my_sin)
 
         retval = krb5_unparse_name(context, *clientp, &name);
         if (retval) {
-            com_err(progname, retval, "While unparsing client name");
+            com_err(progname, retval, _("while unparsing client name"));
             exit(1);
         }
 
         retval = krb5_enctype_to_string(*etype, etypebuf, sizeof(etypebuf));
         if (retval) {
-            com_err(progname, retval, "While unparsing ticket etype");
+            com_err(progname, retval, _("while unparsing ticket etype"));
             exit(1);
         }
 
-        printf("authenticated client: %s (etype == %s)\n", name, etypebuf);
+        printf(_("authenticated client: %s (etype == %s)\n"), name, etypebuf);
         free(name);
     }
 
@@ -1401,7 +1403,7 @@ recv_database(context, fd, database_fd, confmsg)
     if (retval) {
         send_error(context, fd, retval, "while reading database size");
         com_err(progname, retval,
-                "while reading size of database from client");
+                _("while reading size of database from client"));
         exit(1);
     }
     if (krb5_is_krb_error(&inbuf))
@@ -1412,7 +1414,7 @@ recv_database(context, fd, database_fd, confmsg)
                    "while decoding database size");
         krb5_free_data_contents(context, &inbuf);
         com_err(progname, retval,
-                "while decoding database size from client");
+                _("while decoding database size from client"));
         exit(1);
     }
     memcpy(&database_size, outbuf.data, sizeof(database_size));
@@ -1427,7 +1429,7 @@ recv_database(context, fd, database_fd, confmsg)
     if (retval) {
         send_error(context, fd, retval,
                    "failed while initializing i_vector");
-        com_err(progname, retval, "while initializing i_vector");
+        com_err(progname, retval, _("while initializing i_vector"));
         exit(1);
     }
 
@@ -1554,22 +1556,20 @@ recv_error(context, inbuf)
     retval = krb5_rd_error(context, inbuf, &error);
     if (retval) {
         com_err(progname, retval,
-                "while decoding error packet from client");
+                _("while decoding error packet from client"));
         exit(1);
     }
     if (error->error == KRB_ERR_GENERIC) {
         if (error->text.data)
-            fprintf(stderr,
-                    "Generic remote error: %s\n",
-                    error->text.data);
+            fprintf(stderr, _("Generic remote error: %s\n"), error->text.data);
     } else if (error->error) {
         com_err(progname,
                 (krb5_error_code) error->error + ERROR_TABLE_BASE_krb5,
-                "signaled from server");
-        if (error->text.data)
-            fprintf(stderr,
-                    "Error text from client: %s\n",
+                _("signaled from server"));
+        if (error->text.data) {
+            fprintf(stderr, _("Error text from client: %s\n"),
                     error->text.data);
+        }
     }
     krb5_free_error(context, error);
     exit(1);
@@ -1623,8 +1623,7 @@ load_database(context, kdb_util, database_file_name)
 
     switch(child_pid = fork()) {
     case -1:
-        com_err(progname, errno, "while trying to fork %s",
-                kdb_util);
+        com_err(progname, errno, _("while trying to fork %s"), kdb_util);
         exit(1);
     case 0:
         if (!debug) {
@@ -1643,23 +1642,21 @@ load_database(context, kdb_util, database_file_name)
             retval = 0;
         if (!debug)
             dup2(save_stderr, 2);
-        com_err(progname, retval, "while trying to exec %s",
-                kdb_util);
+        com_err(progname, retval, _("while trying to exec %s"), kdb_util);
         _exit(1);
         /*NOTREACHED*/
     default:
         if (debug)
             printf("Child PID is %d\n", child_pid);
         if (wait(&waitb) < 0) {
-            com_err(progname, errno, "while waiting for %s",
-                    kdb_util);
+            com_err(progname, errno, _("while waiting for %s"), kdb_util);
             exit(1);
         }
     }
 
     error_ret = WEXITSTATUS(waitb);
     if (error_ret) {
-        com_err(progname, 0, "%s returned a bad exit status (%d)",
+        com_err(progname, 0, _("%s returned a bad exit status (%d)"),
                 kdb_util, error_ret);
         exit(1);
     }
diff --git a/src/util/support/plugins.c b/src/util/support/plugins.c
index f457f35426..2ab7436bb9 100644
--- a/src/util/support/plugins.c
+++ b/src/util/support/plugins.c
@@ -174,7 +174,7 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct
         if (stat (filepath, &statbuf) < 0) {
             err = errno;
             Tprintf ("stat(%s): %s\n", filepath, strerror (err));
-            krb5int_set_error(ep, err, "unable to find plugin [%s]: %s",
+            krb5int_set_error(ep, err, _("unable to find plugin [%s]: %s"),
                               filepath, strerror(err));
         }
     }
@@ -267,10 +267,10 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct
             if (handle == NULL) {
                 const char *e = dlerror();
                 if (e == NULL)
-                    e = "unknown failure";
+                    e = _("unknown failure");
                 Tprintf ("dlopen(%s): %s\n", filepath, e);
                 err = ENOENT; /* XXX */
-                krb5int_set_error(ep, err, "unable to load plugin [%s]: %s",
+                krb5int_set_error(ep, err, _("unable to load plugin [%s]: %s"),
                                   filepath, e);
             }
         }
@@ -293,7 +293,7 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct
         if (handle == NULL) {
             Tprintf ("Unable to load dll: %s\n", filepath);
             err = ENOENT; /* XXX */
-            krb5int_set_error (ep, err, "unable to load DLL [%s]", filepath);
+            krb5int_set_error(ep, err, _("unable to load DLL [%s]"), filepath);
         }
 
         if (!err) {
@@ -309,7 +309,7 @@ krb5int_open_plugin (const char *filepath, struct plugin_file_handle **h, struct
 
     if (!err && !got_plugin) {
         err = ENOENT;  /* no plugin or no way to load plugins */
-        krb5int_set_error (ep, err, "plugin unavailable: %s", strerror(err));
+        krb5int_set_error(ep, err, _("plugin unavailable: %s"), strerror(err));
     }
 
     if (!err) {