Section: 12.2 Mutual authentication
Content: For authentication between NEF and an AF that resides outside the 3GPP operator domain, mutual authentication based on client and server certificates shall be performed between the NEF and AF using TLS. Certificate based authentication shall follow the profiles given in 3GPP TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5], clause 6.1.3a. The identities in the end entity certificates shall be used for authentication and policy checks. The structure of the PKI used for the certificate is out of scope of the present document.