Subject: [AAA-WG]: [Issue] TLS usage issues

From: Bernard Aboba <[email-masked]>
Date: Sat, 29 Dec 2001 12:59:53 -0800 (PST)

Submitter: Bernard Aboba <[email-masked]>
Date: December 28, 2001
Reference: 
Document: BASE-08
Comment type: T
Priority: S 
Section: 2.2
Rationale/Explanation of issue: 
There is no discussion of how TLS authentication is used with
Diameter. For example:

 a. Are both peers required to support certificates?
 b. If not, how is it decided which peer authenticates to who?

Proposed change:

Add:

"Diameter clients act as TLS clients according to [RFC2246], and Diameter
servers act as TLS servers. Diameter clients and servers implementing
TLS for security MUST mutually authenticate as part of TLS session
establishment. In order to ensure mutual authentication, Diameter servers
MUST request certificates from Diameter clients, and the client MUST be
prepared to supply a certificate on request."