Stop a copied token at the picture service
05The picture service checks both the permission note and the certificate used on this connection. Copying the note alone should not open the gate.
TLS library input: private-key proof passed for the selected certificate.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The selected token is trusted, active and allowed; this TLS connection proves the same certificate A.
Key idea: Valid token plus matching certificate proof; either failure stops access.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
Valid token plus matching certificate proof; either failure stops access.
These reference examples may differ from the selected experiment.
- The resource request MUST use mTLS with the same certificate used at the token endpoint. A certificate mismatch is HTTP 401 invalid_token.
- Obtain the certificate from the TLS layer. First establish trusted token facts, locally or by introspection; decoding JWT text alone is insufficient.
- The API needs advance mTLS policy: the token arrives after the initial TLS certificate request. Certificate-chain validation is not necessary here when mTLS serves only as possession proof (§6.2).
- A new certificate, even with the same key, needs a new bound access token (§6.3). Ordinary issuer, expiry, audience and permission checks still apply.
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.