KRB5KDC_ERR_INVALID_CERTIFICATE
case KRB5KDC_ERR_INVALID_CERTIFICATE:
retval = KRB5KDC_ERR_INVALID_CERTIFICATE;