It entails a far more restrictive list of conditions to validate the KDC's certification, largely it needs a KDC certificate using an EKU of “KDC Authentication” (see possibility b. earlier mentioned).  Distinct certificates are associated with the logon system and as many of