On 11/20/23 14:09, Ken Hornstein via Kerberos wrote: > I guess what I was thinking was maybe not EVERY pkiDebug() call, but > more all of the ones that report errors. I think we're in agreement. Setting an extended error message should generally be sufficient, as it should get trace logged by libkrb5 or included in the KDC log.