Entrust PKI as a Service

Enabling KDC authentication on request

KDC authentication is an Extended Key Usage (EKU) that indicates that a Kerberos Key Distribution Center (KDC) uses a certificate to prove its identity during PKINIT (certificate-based Kerberos authentication). This allows a server (typically a domain controller) to authenticate itself to Kerberos clients by using a certificate instead of a password or secret.

Follow the steps below to issue certificates supporting KDC authentication.

Adding a request extension for KDC authentication

Add the following optionalCertificateRequestDetails.extensions field to the certificate request.

"optionalCertificateRequestDetails": {
    "extensions": [
        {
            "oid": "2.5.29.37",
            "value": "1.3.6.1.5.5.7.3.1,1.3.6.1.5.2.3.5"
        }
    ]
}

Where:

  • oid the 2.5.29.37 identifier of the Extended Key Usage (EKU) extension.
  • value is a list of two identifiers:
    • 1.3.6.1.5.5.7.3.1 for TLS/SSL server authentication.
    • 1.3.6.1.5.2.3.5 for KDC authentication with Kerberos PKINIT.

Selecting a profile that supports KDC authentication

Select a profile that allows the Extended Key Usage (2.5.29.37) extension — for example, one of the profiles listed in the following sections.

You can also create a profile with this extension by following Customizing certificate profiles.