Subject: RE: PKINIT-23 comments: KDC_ERR_CERTIFICATE_MISMATCH

From: "Paul Leach" <[email-masked]>
Date: Mon, 7 Feb 2005 23:27:59 -0800

I agree with sending back a "best guess" instead of an error. It
probably would save a round trip.

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-krb-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Monday, February 07, 2005 5:11 PM
> To: Liqiang(Larry) Zhu; [email-masked]
> Subject: Re: PKINIT-23 comments: KDC_ERR_CERTIFICATE_MISMATCH
> 
> 
> 
> On Sunday, February 06, 2005 07:14:51 PM -0800 "Liqiang(Larry) Zhu"
> <[email-masked]> wrote:
> 
> > The current text:
> >
> >    The KDC MUST return error code KDC_ERR_CERTIFICATE_MISMATCH if
the
> >    client included a kdcCert field in the PA-PK-AS-REQ and the KDC
does
> >    not have the corresponding certificate.
> >
> > Most likely the client will need to retry without specifying a
kdcCert.
> >
> > If this is the most common case, we should just ignore the kdcCert
if we
> > do not have the public key the kdcCert field specifies and send back
a
> > reply (instead of a KRB-ERROR). Any comments?
> 
> This is still open, and is ticket #838.
> 
> -- Jeff
>