Section: 13.3.8.3 Verification of Client credentials assertion
Content: The verification of the CCA shall be performed by the receiving node, i.e., NRF or NF Service Producer in the following way: It validates the signature of the JWS as described in RFC 7515 [45]. It validates the timestamp (iat) and/or the expiration time (exp) as specified in RFC 7519 [44]. If the receiving node is the NRF, the NRF validates the timestamp (iat) and the expiration time (exp). If the receiving node is the NF Service Producer, the NF Service Producer validates the expiration time and it may validate the timestamp. It checks that the audience claim in the the CCA matches its own type. It verifies that the NF instance ID of the NFc in the CCA matches the NF instance ID in the public key certificate used for signing the CCA.