Figure 4: MTAs use Kerberos with PKINIT to obtain tickets from a TGS. These tickets are subsequently used to establish a session with a CMS.