So I created a Single Web Application: rootsite.contoso.com with a Root Site Collection. I set the Authentication in the Web App to use Kerberos and then Set the SPN for the AppPool account running the Web App with HTTP/rootsite.contoso.com
and HTTP/rootsite
.
Checking for Kerberos via Fiddler and it works, wonderful. However, now it seams I have to Add Each Host-Named Site Collection to the same Service Account running the AppPool in order for these sites to render via Kerberos.
Is this correct? I'm concerned first that it's a maintenance issue, and second, that the list of SPN values will get out of hand.