Use active master key in update_princ_encryption kdb5_util update_princ_encryption should update to the active master key version, not the most recent. https://github.com/krb5/krb5/commit/4ccc18bc3ddc49d0fd0d2de00ec91c0fa44c53a8 Author: Greg Hudson Commit: 4ccc18bc3ddc49d0fd0d2de00ec91c0fa44c53a8 Branch: master doc/admin/admin_commands/kdb5_util.rst | 4 ++-- src/kadmin/dbutil/kdb5_mkey.c | 15 +++++---------- 2 files changed, 7 insertions(+), 12 deletions(-)