Internet Key Exchange uses X.509 certificates for authentication ‒ either pre-shared or distributed using DNS (preferably with DNSSEC) and a Diffie-Hellman key-exchange ‒ to set up a session Shared Secret from which Cryptographic Keys are derived