Question: In a Network Function (NF) requesting additional certificates, how is the PKIMessage, containing the Certification Request, signed and what is the mandatory content of the extraCertsField?
Option 1: Signed with a randomly generated private key; extraCertsField contains only the NF's root certificate.
Option 2: Signed with the private key related to the last received operator-provided NF certificate; extraCertsField mandatorily contains the NF certificate (and intermediate CA certificates if not directly signed by a root CA).
Option 3: Signed with the operator's private key; extraCertsField is optional and may contain any CA certificate.
Option 4: Not signed; extraCertsField is mandatory but only for intermediate CA certificates.
Explanation: This option correctly reflects the specified security protocol for Certification Requests in NFs. Signing with the private key related to the last received operator-provided NF certificate ensures authenticity and trust. The mandatory inclusion of the NF certificate (and any necessary intermediate CA certificates) in the extraCertsField facilitates a complete verification chain, crucial for secure authentication in telecom networks.