{
  "port": 9878,
  "protocol": "udp",
  "service": "kca-service — KX509 certificate issuance",
  "oneLiner": "KX509, which trades a Kerberos ticket for a short-lived X.509 certificate — UDP only; TCP 9878 is Reserved.",
  "whatItIs": "RFC 6717 documents kx509 as deployed in 2012: a client sends a single UDP request containing a Kerberos service ticket and a public key, and a Kerberized certificate authority replies with a matching X.509 certificate. IANA registers UDP 9878 as `kca-service` and explicitly marks TCP 9878 as Reserved, so a TCP listener here is not KX509. Deployment was largely university campuses bridging Kerberos realms to PKI-based services; clients can also find the KCA through `_kca._udp.REALM` SRV records.",
  "exposure": {
    "verdict": "never",
    "note": "This is a certificate authority endpoint. It authenticates callers with Kerberos, but a CA's issuance interface belongs inside the realm it serves, not on a public address."
  },
  "checkCommand": "nc -vzu TARGET 9878",
  "links": [
    {
      "title": "RFC 6717 — kx509 Kerberized Certificate Issuance Protocol in Use in 2012",
      "url": "https://www.rfc-editor.org/rfc/rfc6717.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}