Properly check the KDC certificate for REALM SAN and KDC EKU.

[michael-dev]

What's the problem?

KDC certificate is not checked against Domain and EKU.

• [x] Bugfix
• [ ] New Feature

What's the solution?

Check Domain SAN and KDC EKU on KDC reply certificate.

• [ ] Includes unit tests
• [x] Requires manual test

What issue is this related to, if any?

None known.

[michael-dev]

I could also provide code to restrict the KDC cert to issuers in the LocalMachine (enterprise) NTAuth store to restrict the issuers in line with what Windows does, but am unsure if this is wanted?

[SteveSyfuhs]

I like it.