Internet Key Exchange uses X.509 certificates for authentication ‒ either pre-shared or distributed using DNS (preferably with DNSSEC) and a Diffie-Hellman key-exchange ‒ to set up a session Shared Secret from which Cryptographic Keys are derived
- based on information obtained 2018-08-03-