[Freeipa-users] Without GSSAPIStrictAcceptorCheck=no, sshd shows a "wrong hostname"?

Hi, I have a Debian (Proxmox) system joined to FreeIPA. I'm trying to log in via SSH using Kerberos, but it doesn't work. If I start a debug SSH server, I get the following output: No key table entry found matching host/h1.h1.int.example.net@ , but hostname -f on the same host reports h1.example.net. /etc/resolv.conf has h1.int.example.net as the domain/search parameter. I think sshd is getting the hostname messed up somehow. Things work if GSSAPIStrictAcceptorCheck=no, but is there something I can fix? Cheers, Álex