Question: For a SEG (Security Edge Protection) CA certificate profile, as per Network Domain Security (NDS) Authentication Framework (AF), what is the requirement for the Issuer Name when used for connections within the same security domain (i.e., elements having the same root CA certificate installed)?
Option 1: The Issuer Name must be the same as the Subject Name in the Interconnection CA certificate.
Option 2: The Issuer Name is not dependent on the root CA but must match the SEG's unique identifier.
Option 3: The Issuer Name can either be the Subject Name of the root CA or an intermediate CA with a valid chain to this root CA.
Option 4: The Issuer Name and Subject Name must always differ to ensure security diversity.
Explanation: Within the same security domain, where elements share the same root CA certificate, flexibility in the certificate hierarchy is allowed for manageability and scalability. Thus, allowing the Issuer Name to be either the root CA's Subject Name or an intermediate CA's Subject Name (as long as there's a valid certificate chain leading back to the root CA) accommodates these operational needs while maintaining security integrity. This aligns with the principle of leveraging existing trust anchors within a domain for internal communications.