---
name: "kvno"
section: "1"
platform: "linux"
package: "krb5"
version: "1.22.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/kvno"
---

# kvno(1)

print key version numbers of Kerberos principals

## NAME

kvno - print key version numbers of Kerberos principals

## SYNOPSIS

**kvno** \[**-c** *ccache*\] \[**-e** *etype*\] \[**-k** *keytab*\] \[**-q**\] \[**-u** \| **-S** *sname*\] \[**-P**\] \[**--cached-only**\] \[**--no-store**\] \[**--out-cache** *cache*\] \[\[{**-F** *cert\_file* \| {**-I** \| **-U**} *for\_user*} \[**-P**\]\] \| **--u2u** *ccache*\] *service1 service2* ...

## DESCRIPTION

kvno acquires a service ticket for the specified Kerberos principals and prints out the key version numbers of each.

## OPTIONS

- **-c** *ccache*

  Specifies the name of a credentials cache to use (if not the default)

- **-e** *etype*

  Specifies the enctype which will be requested for the session key of all the services named on the command line.  This is useful in certain backward compatibility situations.

- **-k** *keytab*

  Decrypt the acquired tickets using *keytab* to confirm their validity.

- **-q**

  Suppress printing output when successful.  If a service ticket cannot be obtained, an error message will still be printed and kvno will exit with nonzero status.

- **-u**

  Use the unknown name type in requested service principal names. This option Cannot be used with *-S*.

- **-P**

  Specifies that the *service1 service2* ...  arguments are to be treated as services for which credentials should be acquired using constrained delegation.  This option is only valid when used in conjunction with protocol transition.

- **-S** *sname*

  Specifies that the *service1 service2* ... arguments are interpreted as hostnames, and the service principals are to be constructed from those hostnames and the service name *sname*. The service hostnames will be canonicalized according to the usual rules for constructing service principals.

- **-I** *for\_user*

  Specifies that protocol transition (S4U2Self) is to be used to acquire a ticket on behalf of *for\_user*.  If constrained delegation is not requested, the service name must match the credentials cache client principal.

- **-U** *for\_user*

  Same as -I, but treats *for\_user* as an enterprise name.

- **-F** *cert\_file*

  Specifies that protocol transition is to be used, identifying the client principal with the X.509 certificate in *cert\_file*.  The certificate file must be in PEM format.

- **--cached-only**

  Only retrieve credentials already present in the cache, not from the KDC.  (Added in release 1.19.)

- **--no-store**

  Do not store retrieved credentials in the cache.  If **--out-cache** is also specified, credentials will still be stored into the output credential cache.  (Added in release 1.19.)

- **--out-cache** *ccache*

  Initialize *ccache* and store all retrieved credentials into it. Do not store acquired credentials in the input cache.  (Added in release 1.19.)

- **--u2u** *ccache*

  Requests a user-to-user ticket.  *ccache* must contain a local krbtgt ticket for the server principal.  The reported version number will typically be 0, as the resulting ticket is not encrypted in the server's long-term key.

## ENVIRONMENT

See *kerberos* for a description of Kerberos environment variables.

## FILES

- **FILE:/tmp/krb5cc\_%{uid}**

  Default location of the credentials cache

## SEE ALSO

*kinit*, *kdestroy*, *kerberos*

## AUTHOR

MIT

## COPYRIGHT

1985-2026, MIT