# WHATPORT(9878)

## NAME

port 9878 — kca-service — KX509 certificate issuance — KX509, which trades a Kerberos ticket for a short-lived X.509 certificate — UDP only; TCP 9878 is Reserved.

Protocol: UDP  
IANA registry

## DESCRIPTION

RFC 6717 documents kx509 as deployed in 2012: a client sends a single UDP request containing a Kerberos service ticket and a public key, and a Kerberized certificate authority replies with a matching X.509 certificate. IANA registers UDP 9878 as `kca-service` and explicitly marks TCP 9878 as Reserved, so a TCP listener here is not KX509. Deployment was largely university campuses bridging Kerberos realms to PKI-based services; clients can also find the KCA through `_kca._udp.REALM` SRV records.

## EXPOSURE

**Do not expose.** This is a certificate authority endpoint. It authenticates callers with Kerberos, but a CA's issuance interface belongs inside the realm it serves, not on a public address.

## CHECK

```sh
nc -vzu TARGET 9878
```

## SEE ALSO

- spec — [RFC 6717 — kx509 Kerberized Certificate Issuance Protocol in Use in 2012](https://www.rfc-editor.org/rfc/rfc6717.html) (rfc-editor.org)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/9878/> · JSON: <https://whatport.net/9878.json> · full dataset: <https://whatport.net/ports.json>