Etienne Urbah's position on 2010-04-15 :

• Original title of this requirement dated 2010-04-14 was  'Clients MUST authenticate Services with SSL certificates'
• I am NOT sure of the meaning of this requirement :
• If it means 'Each Service MUST send the SSL certificate of its Server to the Client', then it is a duplicate of AA1
• If it means 'Each Client MUST verify the SSL certificate sent by any Server', then :
  - I suggest to change the title of the requirement accordingly
  - This implicitly requires that each Client keeps a list of Certificate Authorities which are trusted to sign SSL certificates of Servers
• Otherwise, please explain

Luigi's answer:

• the requirement means that any client MUST be able to authenticate the service with which is interacting.
• before your explanation, the AA1 requirement was not sufficiently clear for me.

Morris, Balazs and Etienne on 2010-04-21

• This requirement was proposed on 2010-04-14
• dropped, because duplicate of earlier one