On 02/05/2013 09:55 PM, Weijun Wang wrote: > It seems the acceptor only creates a subkey when RFC 4537 is requested. > Is that true? I'm looking for an acceptor side configuration that forces > a subkey always being created. I believe the MIT krb5 GSS acceptor generates a subkey whenever CFX or DCE is used, as of 1.7.