def _secure(self, to, From, authorize):
        """
        Response to a SECURE command, starting TLS when necessary, and using a
        certificate identified by the I{To} header.

        An occurrence of I{Secure} on the wire, together with the response
        generated by this method, might have the following appearance::

            C: -Command: Secure
            C: -Ask: 1
            C: To: divmod.com
            C: From: twistedmatrix.com
            C: Authorize: True
            C:
            Client Starts TLS here with twistedmatrix.com certificate
            S: -Answer: 1
            S:
            Server Starts TLS here with divmod.com certificate

        """
        if self.hostCertificate is not None:
            raise RuntimeError("Re-encrypting already encrypted connection")
        CS = self.service.certificateStorage
        ourCert = CS.getPrivateCertificate(str(to.domainAddress()))
        if authorize:
            D = CS.getSelfSignedCertificate(str(From.domainAddress()))
        else:
            self.authorized = False
            return {'tls_localCertificate': ourCert}

        def hadCert(peerSigned):
            self.authorized = True
            self._cacheMeNow(From, to, authorize)
            return {'tls_localCertificate': ourCert,
                    'tls_verifyAuthorities': [peerSigned]}

        def didNotHaveCert(err):
            err.trap(KeyError)
            return self._retrieveRemoteCertificate(From, port)

        D.addErrback(didNotHaveCert)
        D.addCallback(hadCert)

        return D