KVNO(1) MIT Kerberos KVNO(1)

# [NAME](#NAME)

kvno - print key version numbers of Kerberos principals

# [SYNOPSIS](#SYNOPSIS)

**kvno** \[**-c** *ccache*] \[**-e** *etype*] \[**-k** *keytab*] \[**-q**] \[**-u** | **-S** *sname*] \[**-P**] \[**--cached-only**] \[**--no-store**] \[**--out-cache** *cache*] \[\[{**-F** *cert\_file* | {**-I** | **-U**} *for\_user*} \[**-P**]] | **--u2u** *ccache*] *service1 service2* ...

# [DESCRIPTION](#DESCRIPTION)

kvno acquires a service ticket for the specified Kerberos principals and prints out the key version numbers of each.

# [OPTIONS](#OPTIONS)

[**-c** *ccache*](#c)

Specifies the name of a credentials cache to use (if not the default)

[**-e** *etype*](#e)

Specifies the enctype which will be requested for the session key of all the services named on the command line. This is useful in certain backward compatibility situations.

[**-k** *keytab*](#k)

Decrypt the acquired tickets using *keytab* to confirm their validity.

[**-q**](#q)

Suppress printing output when successful. If a service ticket cannot be obtained, an error message will still be printed and kvno will exit with nonzero status.

[**-u**](#u)

Use the unknown name type in requested service principal names. This option Cannot be used with *-S*.

[**-P**](#P)

Specifies that the *service1 service2* ... arguments are to be treated as services for which credentials should be acquired using constrained delegation. This option is only valid when used in conjunction with protocol transition.

[**-S** *sname*](#S)

Specifies that the *service1 service2* ... arguments are interpreted as hostnames, and the service principals are to be constructed from those hostnames and the service name *sname*. The service hostnames will be canonicalized according to the usual rules for constructing service principals.

[**-I** *for\_user*](#I)

Specifies that protocol transition (S4U2Self) is to be used to acquire a ticket on behalf of *for\_user*. If constrained delegation is not requested, the service name must match the credentials cache client principal.

[**-U** *for\_user*](#U)

Same as -I, but treats *for\_user* as an enterprise name.

[**-F** *cert\_file*](#F)

Specifies that protocol transition is to be used, identifying the client principal with the X.509 certificate in *cert\_file*. The certificate file must be in PEM format.

[**--cached-only**](#cached)

Only retrieve credentials already present in the cache, not from the KDC. (Added in release 1.19.)

[**--no-store**](#no)

Do not store retrieved credentials in the cache. If **--out-cache** is also specified, credentials will still be stored into the output credential cache. (Added in release 1.19.)

[**--out-cache** *ccache*](#out)

Initialize *ccache* and store all retrieved credentials into it. Do not store acquired credentials in the input cache. (Added in release 1.19.)

[**--u2u** *ccache*](#u2u)

Requests a user-to-user ticket. *ccache* must contain a local krbtgt ticket for the server principal. The reported version number will typically be 0, as the resulting ticket is not encrypted in the server's long-term key.

# [ENVIRONMENT](#ENVIRONMENT)

See *kerberos* for a description of Kerberos environment variables.

# [FILES](#FILES)

[**FILE:/tmp/krb5cc\_%{uid}**](#FILE:/tmp/krb5cc___uid_)

Default location of the credentials cache

# [SEE ALSO](#SEE_ALSO)

*kinit*, *kdestroy*, *kerberos*

# [AUTHOR](#AUTHOR)

MIT

# [COPYRIGHT](#COPYRIGHT)

1985-2026, MIT

1.22.2

---

Document: kvno(1) from krb5 1.22.2-r5 (Chainguard OS)
Source: https://github.com/krb5/krb5.git