: If servers are in different domains or workgroups, both need a certificate from a trusted CA with Client and Server Authentication