Study on automated certificate management in Service-Based Architecture (SBA)
The objectives of this study are to identify key issues, potential security and privacy requirements and solutions with respect to
- Standardise the use of a single automated certificate management protocol and procedures for certificate life cycle events within intra-PLMN 5G SBA (i.e. to be used by all 5GC NFs including NRF, SCP, SEPP etc.).
- Study the impact of service mesh in certificate management within 5G SBA.
- Study which lifecycle events (e.g., enrolment, renewal, revocation (e.g., OCSP, CRLs), status monitoring) of a certificate need to be covered.
- Study the relation between certificate management lifecycle and NF management lifecycle.
- Study to reference at minimum following principles:
- Principle to be reusable when 5G SBA is for NPN (standalone and PNI)
- Principles standardised to be able to support NFs doing mutual TLS in Slicing.
- Principles standardised to support both intra and inter PLMN, in the latter referring to SEPP certificates in N32 interfaces and potential cross-certification considerations.
- Principles involving 'Chain of Trust' of Certificate Authorities hierarchies.
- Principles for security of CA's cryptographic private key.