Subject: [AAA-WG]: CMS Security certificate question

From: Don Zick <[email-masked]>
Date: Wed, 02 Jan 2002 15:29:17 -0500

From Section 3.1 of the Diameter CMS Security Application draft 3:

>Otherwise, the destination node returns the DSAA message which
>contains:
>
>    - TTL for this DSA (seconds)
>    - a chain of CA certificates (possibly empty)
>    - public key certificates for the Diameter servers in the realm,
>      all of which MUST validate up to one of the CA's contained in
>      the DSAR message, via the chain of CA certificates above;
>....

Why should a DSAA ever contain more than one public key certificate?

From Section 3.2:

>For multiple Diameter servers within a realm that share a public key,
>each server's identity is encoded in the subjectAltName extension.
>This allows any server within a realm to decrypt AVPs intended for
>that realm.

Thanks,
Don