Subject: [Ietf-krb-wg] Causes for KDC_ERR_CLIENT_NOT_TRUSTED

From: Thomas Harning <[email-masked]>
Date: Wed, 30 Jan 2008 11:00:34 -0500

Is there any definitive source of KDC_ERR_CLIENT_NOT_TRUSTED ... in the documents it 
mentions these two vague ones (really, just 1 w/ an example):
  * Policy
  * OID for Login not present

I'm primarily interested in information related to using Hiemdal w/ PKINIT to login into 
Windows 2003 Server.....
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Olga Kornievskaia <[email-masked]>
Date: Wed, 30 Jan 2008 11:49:04 -0500

This means that your Windows server is missing client's ca certificate.

Remember that windows 2003 server doesn't implement rfc pkinit, instead 
it implements draft-9 version of the pkinit rfc.

 From draft-9 (section 3.2):
"If the KDC has no certificate signed by any of the trustedCertifiers, 
then it returns
 an error of type KDC_ERR_KDC_NOT_TRUSTED"

-Olga

Thomas Harning wrote:
> Is there any definitive source of KDC_ERR_CLIENT_NOT_TRUSTED ... in 
> the documents it mentions these two vague ones (really, just 1 w/ an 
> example):
>  * Policy
> I'm primarily interested in information related to using Hiemdal w/ 
> PKINIT to login into Windows 2003 Server.....
>