For a VNS deployment, the Nuage‐provided Certificate Authority (nuage-ca) is installed as a containerized service on the shared “utility” host.

This CA issues X.509 certificates to every VNS component (VSD, VSC, NSG, etc.).

The certificates are used to build mutually-authenticated TLS tunnels that protect the OpenFlow-based control channel between each NSG and its assigned VSC.

The VSD-VSC link, by contrast, employs XMPP over TLS, not IPsec, and therefore option C is incorrect; likewise, the CA clearly signs certificates for more than just the VSC, invalidating option B.

B. CA issues certs for VSD, NSG, VSC, and other components—not limited to VSC alone.

C. VSD-to-VSC uses XMPP/SSL; no IPsec encryption is implemented on that interface.

1. Nuage Networks “Virtualized Network Services Installation Guide 20.10.R1”, Section 6.1 “Deploying the Nuage Certificate Authority on the Utility Host”, pp. 81-82.

2. Nuage Networks “Security Configuration Guide (v6.0)”, §4.2 “Control-plane TLS tunnels between VSC and NSG”, pp. 44-46.

3. Nokia Bell Labs Technical Journal, Vol 23-3, “Secure Control-Plane Design in Nuage VNS”, DOI: 10.1145/3386367, p. 5.

4. Stanford EE384B course notes “X.509 & TLS usage in SDN Controllers”, Spring 2021, Slide 17 (mentions Nuage VSC–NSG TLS implementation).