[19307] in Kerberos_V5_Development
Re: X.509 preauth
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Oct 30 23:18:38 2015
To: Pascal Jakobi <pascal.jakobi@gmail.com>, krbdev@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <56343301.8040500@mit.edu>
Date: Fri, 30 Oct 2015 23:18:25 -0400
MIME-Version: 1.0
In-Reply-To: <5633EBE0.6070103@gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 10/30/2015 06:14 PM, Pascal Jakobi wrote:
> PA-PK-AS-REQ (16), which I understand is for X.509 certificate
> preauthentication, is not in the list.
[...]
[From krb5.conf]
> pkinit_anchors = FILE:/var/kerberos/krb5kdc/cacert.pem
> pkinit_identities = FILE:/var/kerberos/krb5kdc/kdccert.pem, /var/kerberos/krb5kdc/kdckey.pem
You should put the KDC certificate paths in "pkinit_identity", and the
client certificate paths in "pkinit_identities". (These are two of the
most confusingly named variables in krb5.conf, and we are considering
introducing new names for them and deprecating the old ones.)
Since the KDC isn't seeing a "pkinit_identity" configured, it isn't
offering PKINIT.
If you haven't read it already, see:
http://web.mit.edu/kerberos/krb5-latest/doc/admin/pkinit.html
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
