Kerberos is ASN.1 based. The Realm names in the current protocol specifications use GeneralString to represent REALM names. GeneralString is being replaced with a new type, KerberosString, in the next revision of the protocol. If you want to read the gory details, read Section 5.2.1 of http://www.isi.edu/people/bcn/krb-revisions/krbclar5-4.htmlOn Tue, Feb 11, 2003, Thomas Anders wrote:Hello,the Kerberos/PKINIT Internet draft (http://www.ietf.org/internet-drafts/draft-ietf-cat-kerberos-pk-init-16.txt, chapter 3.2.2.2) requires the KDC certificates to specify Kerberos realm and principal name in the subjectAltName extension with type-id 1.3.6.1.5.2.2. Is there a way to specify such a subjectAltName extension in openssl.cnf? If this can only be done by specifying "subjectAltName=DER:...", how can I create the appropriate DER data?Thats a rather weird extension: it uses an odd type and some unnecessary tagging. Creating it manually would be rather difficult. You could use the mini-ASN1 compiler in OpenSSL 0.9.8 but it doesn't currently directly handle GeneralString (its not apparent why the draft should use that as opposed to UTF8String) I'll fix it so it does.
As for PKINIT, I will predict that the current draft will not survive in its current form. The reason it is at revision 16 is not because there have been numerous revisions but because the I-D has simply been republished for years while the Kerberos Working Group is focused on getting out revisions to the core protocols.
