Subject: concerning PANA over TLS

From: Julien Bournelle <[email-masked]>
Date: Tue, 26 Nov 2002 15:31:09 +0100

Hi all,

 I was reading PANA over TLS draft and something is not clear in my mind.
When a PaC wants to gain access it must set up a TLS session with a PAA to be
authenticated. For this it must be able to verify PAA's certificate. What
is not clear for me is the case where the PaC is in a visited domain, for
example PaC belongs to xyz.com domain and can verify certificate of
this domain. Now xyz.com has roaming agreement with abc.net, do we assume
that PaC can also verify certificate from this new domain ?

Maybe I miss something but it could be interesting to clarify cases 
of authentication in visited domain.

[email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 27 Nov 2002 03:22:03 -0500

> that PaC can also verify certificate from this new domain ?

Yes.  A TLS server certificate in PANA over TLS can be verified in the
same way as you verify a TLS server certificate when using https.
It works regardless of the client domain.

> [email-masked]

Thanks,
Yoshihiro Ohba