Section: 13.3.8.2 Client credentials assertion
Content: CCAs shall be JSON Web Tokens as described in RFC 7519 [44] and are secured with digital signatures based on JSON Web Signature (JWS) as described in RFC 7515 [45]. The CCA shall include: - the NF instance ID of the NF Service Consumer (subject); - A timestamp (iat) and an expiration time (exp), and - The NF type of the expected audience (audience), i.e. the type "NRF" and/or the NF type of the NF Service Producer. The NF Service Consumer shall digitally sign the generated CCA based on its private key as described in RFC 7515 [45]. The signed CCA shall include one of the following fields: - the X.509 URL (x5u) to refer to a resource for the X.509 public key certificate or certificate chain used for signing the client authentication assertion, or - the X.509 Certificate Chain (x5c) include the X.509 public key certificate or certificate chain used for signing the client authentication assertion.