Question: For an SCP entity's TLS certificate in the context of Network Domain Security (NDS), which of the following is a valid requirement regarding its issuance and content?
Option 1: The TLS certificate shall be directly signed by the CA in the operator domain that the SCP entity belongs to, without specific subjectAltName requirements for URI-ID or DNS-ID.
Option 2: The TLS certificate must be signed by an external, trusted third-party CA, with a subjectAltName containing both URI-ID for apiRoot and DNS-ID for NF service callback URIs.
Option 3: The SCP entity can use a self-signed TLS certificate, as long as it includes subjectAltName with wildcard URIs for the HTTPS API(s) and FQDN(s) of the NF service callback URI(s).
Option 4: The TLS certificate's issuance is not specified, but it must contain a subjectAltName with both IP address and email address of the SCP entity.
Explanation: This option correctly reflects the specific exemption for SCP certificates from general NF certificate profile requirements regarding subjectAltName (URI-ID and DNS-ID). The direct signing by the operator domain's CA is also accurately stated, ensuring security and trust within the network domain.