Re: Request for new work item - Defining an SRV RR otherName

[Sam Hartman <hartmans-ietf@xxxxxxx>]

>>>>> "Stefan" == Stefan Santesson <stefans@xxxxxxxxxxxxx> writes:

    Stefan> Sam, My recollection of this issue is a bit different from
    Stefan> yours.

    Stefan> The central need here is to enable the KDC to express in a
    Stefan> certificate the fact that it is a KDC in a way that male
    Stefan> sense to clients.


If this is all you want, bind the KDC certificate to the TGS principal
for the realm. That's what Larry's pkinit 26 text does.

The original problem with that solution is that it required CAs to
implement the kerberos OtherName.  However this approach also requires
the CA to implement a new OtherName.