Share via

3.1.5.2.1.1 SAN DNSName field

  • Article

The KDC MUST confirm that the name of the account found matches the computer name in the DNSName field of the certificate terminated with "$" and that the DNS domain name in the DNSName field of the certificate matches the DNS domain name of the realm. Implementations of PKCA KDCs which use Active Directory for the account database MUST use the sAMAccountName attribute ([MS-ADA3] section 2.222) for the computer name. If they do not match, the KDC SHOULD return KDC_ERR_CLIENT_NAME_MISMATCH.