Match a certificate already on the guest list
03Instead of trusting an issuer chain, the server can keep this app’s exact certificate on a registered list. A self-signed card is not an automatic invitation.
Assume client_id=photo-app and a successful TLS private-key proof. No client CA-chain check is used for this method.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The exact registered certificate matches, and TLS possession proof is assumed verified.
Key idea: For this method, register the certificate, not just its name or public key.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
For this method, register the certificate, not just its name or public key.
These reference examples may differ from the selected experiment.
- self_signed_tls_client_auth checks proof of the private key and a matching registered certificate. It does not validate the client chain.
- jwks or trusted jwks_uri supplies JWKs with x5c certificates. Required public-key members remain present and must agree with x5c, but are not used as the certificate match.
- A renewed certificate with the same key needs the registered certificate set updated. A trusted jwks_uri can provide the new set.
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.