Match a trusted certificate to the app’s name
02The token issuer knows photo-app and expects one registered certificate subject. Check the issuer chain and that subject before accepting the app.
client_id selects photo-app’s registered configuration.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The proven certificate has a validated chain and the one expected SAN name.
Key idea: A trusted certificate still has to match the configured client.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
A trusted certificate still has to match the configured client.
These reference examples may differ from the selected experiment.
- tls_client_auth uses a validated chain and exactly one registered DN or SAN subject value. This example selects a dNSName SAN, lesson.example.
- client_id is required for mTLS OAuth client authentication. Missing or mismatched certificates produce invalid_client; TLS failures may stop earlier.
- DN comparison needs predictable matching rules; IP SAN values compare as binary addresses. Revocation checking is a deployment choice. Limit trusted CAs to suitable issuance policies (§7.4).
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.