rekeying krbtgt

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--dTKT7Cl81Ng6bo5WX6T07tDEHS2UwGDQC
Content-Type: multipart/mixed; boundary="P9ohjNeDjXUk9rb6k11h1kWabsIh8VhOk";
 protected-headers="v1"
From: =?UTF-8?Q?Radoslav_Bod=c3=b3?= <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: rekeying krbtgt

--P9ohjNeDjXUk9rb6k11h1kWabsIh8VhOk
Content-Type: text/plain; charset=iso-8859-2
Content-Transfer-Encoding: quoted-printable

Hello,

we are trying to rekey old principals and get rid of the old `des-*`
enctypes, possibly without any service downtime. So far we've been able
to come up with rekeying procedure for service principals using
ktutils+kadmin (https://github.com/bodik/rekey/blob/master/rekey.py#L415)=


Now I'm little bit wondering how to rollover the krbtgt principal, I've
found `cpw --keepold` functionality which nicely adds a new keys
(kvno+1) for existing principal with requested keytypes ([kadmin]
default_keys), but i cannot find a way how to selectively delete the old
key by kvno...

any advice would be very apprecitated

Best regards
Radoslav Bodo


--P9ohjNeDjXUk9rb6k11h1kWabsIh8VhOk--

--dTKT7Cl81Ng6bo5WX6T07tDEHS2UwGDQC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE/K4LADJRINmApAZ9dGkZA5oELrMFAlthZJYACgkQdGkZA5oE
LrMNqw//e65bk5AypDVKz8RRXLOUMBo2/j27JqJ+V8/xik79tJPDX92BO7QzC0NS
qFG127N9uasFe2l6OpTeO9e6dvqkzQPV8CIndEklPYMi56uo6xy3WWqEUItWaD1A
u8cg0lCVqjhW64lZqjIrOkIh+lVUd2yqg6pVHzf/EWpHPmzXtXgdMa5jUVzWE9Yt
6Z+C6gf1MdDijyaCbU4jIDG+lV6ONGCVJsiY3PhJQ80ce7om7UkCIJ0RNZ60GDTU
ITDvBKwvT1jOENHDZPzo91sA27mDruZrLAxXowNwiNcikmYmxkyEwhwCI67JdPJO
XGHxX7kAGTe212kVwI9pl5b67OHeVokwO1l7EYIXiXt7P4oq1tvJsxJVQSN4mYP9
Z/aT2fjbvG4B5FOfh+JJehk6cCqshS5rt/cd/7t3WRgLttJZFXDiXCSclQGwb93Y
xVZNRv3tIJYPcAnilhsZJr+JhGmMzw67i0tMsONVH9RdickDAcxliFCTP6bsrAEX
raHuqrmzDuGsA8U1+iRVD0n8Az6lpXTEyyYTcC23lYmgUbN0Aa27B/YpHuY6+X5k
La23nN79G/962ngKR+6GNV+yfOqmkxsKBJJBfN/wvlr+e9MpyRsE017ng2BJtvft
Uq0sGRKAwXLLpdk6iN0B4eBNmUQpTtDhr+l/Og2Ov7qbKutI9ak=
=VI1Z
-----END PGP SIGNATURE-----

--dTKT7Cl81Ng6bo5WX6T07tDEHS2UwGDQC--