Figure 1

Figure 1: Kerberos only accepts certificates for authentication whose issuing CA can be found in the NTAuth container.