The mTLS support for SBI interfaces feature has the relationship with TLS transport support feature. The following are the roles associated with the AMF:

• Server Configuration in AMF

• Client Configuration in AMF

For related information, see the TLS Transport Support chapter in this document.

The mTLS Support for SBI interfaces feature has the following prerequisite:

• The user must procure and configure the following:

  • Certificate Authority (CA) certificates

  • Other certificates or keys necessary for the server and the client

• For more information on the following topics, see the TLS Transport Support chapter in this document.

  • For the client, and the server certificate configuration

  • For the ca-certificate configuration

  • For uri-scheme https, in the profile nf-client configuration

This feature has the following limitations:

• The mTLS secure channel support feature for the AMF provides transport layer encryption between nodes for security compliance purposes only.

• The AMF doesn’t support NF security requirements as per 3GPP specifications of 5G.

• The AMF supports L1-X1 over the UDP in Cisco format only. As a result, the AMF doesn’t support the mTLS on the L1-X1 interface.

• The AMF doesn’t support dynamic mTLS CLI change configuration.

To configure this feature, use the following configuration:

config 
    instance instance-id instance_id 
        endpoint sbi 
            uri-scheme {http | https} 
            mtls-enable {false | true} 
            certificate-name certificate_name 
            end 

NOTES:

• instance instance-id instance_id —Specify the instance ID.

• endpoint sbi —Specify the endpoint as sbi .

• uri-scheme {http | https} —Specify the uri-scheme as https. The default value is http.

• mtls-enable {false | true} —Specify the mTLS configuration as either true or false.

• certificate-name certificate_name —Specify the certificate name for the server which is used by AMF for HTTPS messages. The list of certificate names is obtained from the nf-tls command.

To configure this feature, use the following configuration. The following commands help in enabling the mTLS option along with the server name at the NF and NRF-related configurations:

config 
    profile nf-client 
        nf-type ausf 
            ausf-profile AUP1 
            locality LOC1 
            service type nausf-auth 
            endpoint-profile ep_profile_name 
                type EP1 
                locality LOC1 
                uri-scheme https 
                server-name server_name 
    group nrf 
        mgmt MGMT_name 
            service type nrf nnrf-nfm 
            endpoint-profile ep_profile_name 
                name mgmt-prof 
                uri-scheme https 
                server-name server_name 
    group nrf 
        discovery udmdiscovery 
            service type nrf nnrf-disc 
            endpoint-profile ep_profile_name 
                name EP1 
                uri-scheme https 
                server-name server_name 
                end 

NOTES:

• profile nf-client nf-type ausf ausf-profile AUP1 —Specify the required NF client profiles and provide the local configuration.

• service type nausf-auth | service type nrf nnrf-nfm | service type nrf nnrf-disc —Specify the service names as per the 3GPP standards.

• group nrf mgmt MGMT_name —Specify the NRF self-management group configurations.

• instance instance-id instance_id —Specify the instance ID.

• endpoint-profile ep_profile_name —Specify the endpoint-profile name.

• uri-scheme {http | https} —Specify the uri-scheme as https. The default value is http.

• server-name server_name —Specify the DNS name (FQDN) of the peer NF and the server-name must match the DNS attribute of the subjectAltName field in the peer NF certificates.