Re: [kitten] Kerberos Service Discovery using DNS

[Greg Hudson <[e-mail]>]

On 03/11/2015 05:25 AM, Rick van Rein wrote:
> SRV records point to a hostname, not an IP address.  This hostname
> is then acceptable for certificates in many protocols — but I’m not
> sure if that applies to the KDC’s certificates for PKINIT as well.

RFC 4556 requires that the KDC certificate contain a SAN of type
id-pkinit-san whose value is the TGT principal name for the realm, and
also an extended key usage value of id-pkinit-KPKdc.

The above applies "unless the client knows by some other means that the
KDC certificate is intended for a Kerberos KDC," and generally client
implementations do provide a way to use a standard SSL server cert for
the KDC with appropriate configuration.  In MIT krb5, the client must
have the valid PKINIT cert hostnames for the realm explicitly configured
in krb5.conf for this option; we do not pay any attention to the
hostname from the transport lookup.

I wouldn't object to security considerations language to make it
explicit that an unauthenticated transport hostname MUST NOT be used to
validate a PKINIT certificate (and maybe that a DNSSEC-authenticated
transport hostname SHOULD NOT be used), but I don't know that it is
necessary.