Keep the proof trustworthy through a front desk
08A proxy may finish TLS before the request reaches the picture service. The service must know which certificate the proxy actually verified, rather than trusting a label sent by anyone.
The picture-service TLS library verifies the client proof.
Offline teaching example. TLS, certificate-chain and token validation results are selected inputs; this page is not a TLS connection or an OAuth server.
What happens if you change this?
Predict whether the request will pass. Change one choice to see why; use Restart to restore the original example.
The local TLS library supplies the certificate for the verified connection.
Key idea: Certificate evidence needs a trusted route from the TLS connection to the application.
Terms
- mutual TLS
- A secure connection where the server checks a client’s certificate and proof of its secret key, as well as the client checking the server.
- certificate-bound token
- A permission note that works only with the particular public certificate and corresponding private key.
Rules & examples
Certificate evidence needs a trusted route from the TLS connection to the application.
These reference examples may differ from the selected experiment.
- TLS termination at an intermediary is permitted. Secure communication of certificate metadata to the application is outside RFC8705; no forwarding header is standardized here.
- A protected authenticated handoff is an example deployment arrangement, not a protocol defined by this RFC. Arbitrary client headers are not TLS evidence.
- Use established X.509 validation libraries (§7.5), current BCP195 TLS guidance (§7.3), and consider client-certificate tracking: TLS1.3 is preferred where possible for single-user apps (§8).
Bounded offline teaching example. TLS, X.509 and token validation results are assumed or selected; no network handshake runs here.
Sources
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.