> What you can see is that the TGT is valid for a longer time (actually > the default ticket lifetime) than the original proxy certificate. > Is it > a misconfiguration? Or a bug? In case of a proxy ceritificates, I think its a bug. I'll make a note about it and fix it. The ticket lifetime should at least be limited by the proxy cert lifetime. Thanks, Love