RFC 4210

Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP)
Standards Track
September 2005
RFC Library > PKI & Certificates > RFC 4210
Abstract: This document describes the Internet X.509 PKI Certificate Management Protocol (CMP). CMP provides online interactions between PKI components, including certificate enrollment, renewal, revocation, and CA key update. CMPv2 is the primary certificate management protocol referenced by 3GPP TS 33.310.
Canonical source: https://www.rfc-editor.org/rfc/rfc4210  |  IETF Datatracker

1. Introduction

▶

CMPv2 defines the messages and procedures for automated certificate lifecycle management. It supports initial enrollment, certificate renewal, key update, revocation, and CA announcements.

3GPP TS 33.310 §6.2 mandates CMPv2 for automated certificate management of NF certificates in operator networks. CMPv2 enables zero-touch provisioning of NF certificates in 5G SBA deployments.

2. CMP Message Types

▶
Message Type Description 3GPP Usage
ir Initialization Request First-time certificate enrollment NF initial provisioning
ip Initialization Response CA response with new certificate —
cr Certification Request Subsequent certificate request NF cert renewal
cp Certification Response CA response with certificate —
kur Key Update Request New key pair with existing cert link NF key rotation
kup Key Update Response CA response to key update —
rr Revocation Request Request certificate revocation NF decommission
rp Revocation Response CA acknowledgment of revocation —
certConf Certificate Confirm End entity confirms acceptance NF confirms cert
pkiConf PKI Confirm CA confirms transaction complete —

3. Enrollment Flow

▶
3GPP Security: TS 33.310 requires that the initial enrollment (ir) uses a shared secret or manufacturer certificate for authentication. Subsequent renewals (kur) use the existing certificate for authentication.
  End Entity (NF)                   CA / RA
|                                |
|  ir (Initialization Request)   |
|  [certReqMsg, POP proof]       |
|------------------------------->|
|                                |
|     ip (Initialization Resp)   |
|     [new certificate, CA certs]|
|<-------------------------------|
|                                |
|  certConf (Confirm receipt)    |
|------------------------------->|
|                                |
|     pkiConf (Transaction done) |
|<-------------------------------|
POP = Proof of Possession (signature with private key)

4. Protection Mechanisms

▶
  • Shared secret (MAC-based): PBMAC1 using initial shared secret — used for first enrollment
  • Signature-based: Existing certificate signs the CMP message — used for renewal/key update
  • TLS transport: CMP over HTTP with TLS for transport-level protection
  • Proof of Possession: Requester proves control of private key via signature in certReqMsg

5. Security Considerations

▶
  • Initial shared secrets must be distributed securely (out-of-band) and used only once
  • RA (Registration Authority) should validate requester identity before forwarding to CA
  • CMPv2 messages should be transported over TLS to prevent eavesdropping of certificate data
  • Key escrow is NOT supported — the CA never has access to the end entity's private key