Subject: PKINIT-23 comments: KDC_ERR_CERTIFICATE_MISMATCH

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Sun, 6 Feb 2005 19:14:51 -0800

The current text: 

   The KDC MUST return error code KDC_ERR_CERTIFICATE_MISMATCH if the
   client included a kdcCert field in the PA-PK-AS-REQ and the KDC does
   not have the corresponding certificate.

Most likely the client will need to retry without specifying a kdcCert. 

If this is the most common case, we should just ignore the kdcCert if we
do not have the public key the kdcCert field specifies and send back a
reply (instead of a KRB-ERROR). Any comments?

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Sun, 6 Feb 2005 22:15:57 -0600

> reply (instead of a KRB-ERROR). Any comments?

You have to send an error anyways.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 07 Feb 2005 20:11:05 -0500

> reply (instead of a KRB-ERROR). Any comments?

This is still open, and is ticket #838.

-- Jeff