3.3 Operator CA Requirements

Operator CA must provide the CMP endpoint, recipient DN, issuer DN if required by policy, issued-certificate trust chain, and TLS trust details when CMP TLS validation is enabled.

Operator CA must trust the OCLM CMP client identity used for signature-protected CMP requests.