I've discovered that tlclient does not accept a smart card cert without any extensions. In tlclient.log, I get:
2013-10-11T16:13:36: Log file created
2013-10-11T16:13:36: ThinLinc client release (Internal version - not for release) build (unknown build)
2013-10-11T16:13:40: Loaded PKCS#11 module '/opt/thinlinc/lib/tlclient/opensc-pkcs11.so'
2013-10-11T16:13:40: Unable to determine if certificate for token "MyEID (Basic PIN)" is for a CA
2013-10-11T16:13:41: Log file ended
Apparently, find_extension in cert.c returns ASN1_ELEMENT_NOT_FOUND if it does not find tbsCertificate.extensions.
The structure is optional in case there are no extensions on the certificate. So we should be able to handle this.
Fixed in r28027.