Section: 15.2 Mutual authentication
Content: If a management service consumer resides outside the 3GPP operator’s trust domain, mutual authentication shall be performed between the management service consumer and the management service producer using TLS. TLS shall follow, the profile given in TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3], clause 6.2 and either 1) the client and server certificates with the profiles given in 3GPP TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5], clause 6.1.3a or 2) pre-shared keys following RFC 5489for TLS 1.2 and RFC 8446 [60] for TLS 1.3. The structure of the PKI used for the certificates is out of scope of the present document. The identities in the end entity certificates shall be used for authentication and policy checks. The key distribution of pre-shared keys for TLS is up to the operator’s security policy and out of scope of the present document.