Attach a certificate fingerprint to a token
04The issuer gives the app an access token: a permission note. It attaches a short, computed fingerprint of the certificate used to obtain it.
The issuer observed certificate a on the token-endpoint TLS connection.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The full certificate bytes determine the 43-character fingerprint. Renewing the card changes the fingerprint even when its key stays the same.
Key idea: The token is bound to the whole certificate, not merely its public key.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
The token is bound to the whole certificate, not merely its public key.
These reference examples may differ from the selected experiment.
- cnf contains x5t#S256: SHA-256 of the complete DER certificate, encoded as base64url without padding, whitespace or line breaks.
- JWT certificate hashes SHOULD use this confirmation member. The hash is not a signature, secret, certificate parser or token validation.
- The lesson computes hashes of fictional public DER certificates. Renewed A uses the same public key but different certificate bytes.
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.