9878
Summary
- // if you see it open
- RFC 6717 notes the public key is sent in cleartext without proof that the requester possesses its corresponding private key; it also identifies privacy and certificate policy considerations.
About port 9878/udp.
UDP port 9878 is registered as kca-service for kx509, a protocol that uses Kerberos tickets to obtain X.509 certificates. The available evidence describes the protocol but does not establish whether any particular host runs it or whether it belongs on the public internet.
RFC 6717 describes a single UDP request and reply. A client uses a Kerberos service ticket to send a public key; the Kerberized Certificate Authority can return a certificate. The RFC says the service is conventionally run on UDP 9878 and is informational, not an Internet Standards Track specification.
The RFC identifies security considerations including cleartext transmission of the public key and certificate, and a lack of proof that the requester possesses the corresponding private key. The described protocol context is Kerberos infrastructure. The sources provide no current deployment, prevalence, or malware measurement, so port registration alone does not establish exposure or safety.
- Service
- IANA registers
kca-serviceon UDP 9878 for the kx509 Kerberized Certificate Issuance Protocol. [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv - Exposure
- Unknown; the protocol evidence does not establish an intended public internet audience. [Unknown] — https://www.rfc-editor.org/rfc/rfc6717.txt
- Security
- RFC 6717 notes that the public key is sent in cleartext and that the protocol does not prove requester possession of the corresponding private key. [Confirmed] — https://www.rfc-editor.org/rfc/rfc6717.txt
Protocol
kx509 uses Kerberos tickets to acquire X.509 certificates.
- Port assignment
kca-serviceis registered for UDP port 9878; described as kx509 in use in 2012. [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- Exchange
- Normal operation consists of one UDP request and one UDP reply. [Confirmed] — https://www.rfc-editor.org/rfc/rfc6717.txt
- Public exposure
- Intended internet accessibility is not established by the supplied evidence. [Unknown] — https://www.rfc-editor.org/rfc/rfc6717.txt
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| kca-service | TCP | The KX509 Kerberized Certificate Issuance Protocol in Use in 2012 | 0.02% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.