3 ms·

You can always have a long term certificate locked in a safe as a fallback to Kerberos

• dikei 7y ago
  The point is you don't need a server-side fallback if you don't use Kerberos, since the server can validate login on its own. The fallback certificate is only client-side, and can be keep offline/air- gap from the main credentials.
  • kerng 7y ago
    You have to provision the key for the fallback cert on server in both cases. So not sure why one would be better then the other...
    • dikei 7y ago
      You don't need to provision key for fallback cert on server, because the server simply trust all certificates that was signed by the CA. You only need to get the CA to sign the fallback cert.