Find the right door from the server’s directions
07Some servers keep the door that asks for a client certificate separate from the ordinary token door. Follow the published directions rather than inventing an address.
Only server-published example URLs are used; this lesson sends no network request.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The published mTLS token alias takes priority for this mTLS request.
Key idea: Use an advertised mTLS endpoint alias when present; otherwise use the ordinary endpoint.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
Use an advertised mTLS endpoint alias when present; otherwise use the ordinary endpoint.
These reference examples may differ from the selected experiment.
- For a direct AS endpoint request intending mTLS, clients MUST prefer that endpoint’s alias when present in mtls_endpoint_aliases. Missing aliases fall back by endpoint name, not by guessing paths.
- tls_client_certificate_bound_access_tokens defaults to false when omitted in AS or client metadata. A client’s intention flag is not a token binding.
- Without mTLS at issuance, the AS may return an error or an unbound token at its discretion. Binding implicit-flow access tokens from the authorization endpoint is outside this RFC (§6.4).
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.