The Utimaco PKCS#11 library locates its global configuration file by reading the CS_PKCS11_R3_CFG environment variable. This variable must be set in any shell or process that will load the library, including the Kron PAM JVM. Setting it in /etc/environment ensures it is available system-wide, including to systemd service units:
[pamuser@KronPAM_Instance]# export CS_PKCS11_R3_CFG=/etc/utimaco/cs_pkcs11_R3.cfg
[pamuser@KronPAM_Instance]# echo 'export CS_PKCS11_R3_CFG=/etc/utimaco/cs_pkcs11_R3.cfg' >> /etc/environment
The export command takes effect in the current shell session immediately. The entry in /etc/environment is read by PAM (the Linux Pluggable Authentication Modules, not Kron PAM) at login time and by systemd when it sources the file for service units. A system reboot or a 'systemctl daemon-reload' followed by service restart will pick up the change for the PAM service.