This clause specifies the following certificate management procedures in SBA for 5GC NFs:

• Set up of initial trust between NF and operator CA/RA.
• Certificate enrolment and renewal for 5GC NFs.
• Validation of usage of X.509 certificates in SBA.
• Certification revocation procedures.

The validation of the trust chain of CA hierarchy is required, ensuring the legitimacy and credibility of the CA. The solutions to establish the trust chain of CA hierarchy are left to implementation. Other mechanisms and use cases related to certificate management for 5GC NFs are described in informative Annex I and left to implementation.

This clause describes the protocols and corresponding procedures for certificate enrolment and renewal for 5G Core Network Functions based on CMP protocol.

The 5G Core NFs in SBA might need to support multiple operator certificates for different purposes, such as TLS authentication, JSON signing and JSON encryption (e.g., for signing access tokens for service access authorization, signing CCA tokens, etc.). The Extended Key Usage (EKU) extension of the X.509 certificate as defined in RFC 5280 and IETF draft-ietf-lamps-nf-eku-01 [63] can be used to indicate the purpose of the X.509 certificates used in SBA. Accordingly, the CA is expected to be configured with policies to validate the purpose of the certificate and add it to the issued certificate, thus the usage of the certificate can be further verified in corresponding procedures (e.g., TLS authentication). If the initial trust is set up by initial certificate and the NF communicates with the operator CA directly, the initial certificate may also carry the Extended Key Usage extension. In that case, during the set up of initial trust procedure described in clause 10.2.3, the extension in the initial certificate is used to indicate the purpose of the end entity certificate that the initial certificate can be used to request from the operator CA/RA. The operator CA/RA verifies the Extended Key Usage extension carried in the certTemplate of the certificate enrolment request corresponds to the Extended Key Usage extension of the initial OAM issued certificate before generating the final certificate for the 5GC NF.

The possible certificate revocation procedures are profiled in clauses 6.1a and 6.1b of the present document.

In the implementation of a certificate lifecycle management framework, the NF lifecycle can be considered. For example, when the certificate of an NF producer instance has been revoked without the knowledge of the NRF, the NRF might return that instance to the NF consumer during the discovery procedure, leading to unnecessary signalling due to the use of non-valid certificates. In that case, during the NF discovery procedure, the NRF may check that the potential producers, to be included in the response, do have valid certificates. How such a check is performed is left to implementation. For example, it can be based on locally stored information or by querying other network entities such as OCSP/CRL servers.