Study of Automatic Certificate Management Environment (ACME) for the Service Based Architecture (SBA)
The scope of this document is to identify key issues and study solutions addressed using ACME for automated certificate management in SBA.
Areas of study include:
- Automated certificate management protocol and procedures for certificate life cycle events (i.e., enrolment,  renewal, and revocation) within 5G SBA (i.e., to be used by operator CAs and all 5GC NFs including NRF,  SCP, SEPP, etc.), including the following:
- ACME transport and request/response messages for 5G SBA use cases
- ACME certificate profiles for all 5G SBA entities
- Mechanisms for establishing initial trust and chain of trust of Certificate Authority hierarchies, including the  following:
- Existing ACME challenge types and if any new challenge types are needed for 3GPP use cases:
- Creation, deletion, rotation, revocation and storage of the certificates
- Ability to automate ACME challenge validation
- Suitability of existing mechanisms when 5G SBA is for standalone NPN (SNPN)
- Call flow of the messages exchanged between different entities in the chain of trust.
NOTE: Certificate management for the external interface of the SEPP is out of scope.