RFC 8705 / START HERE
OAuth mutual TLS, before the details
OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens. TLS means Transport Layer Security; mutual means both sides show certificate-based proof. OAuth is a framework for apps to obtain permission to use a service.
An app can show a public certificate and prove it holds the matching secret key. A token issuer can use that proof to check the app’s registered identity, or attach a permission note to that particular certificate. These are separate features.
Why it exists
An ordinary bearer token can be used by anyone who copies it. A certificate-bound token also needs the matching key on the connection to the service. RFC 8705 defines the client-authentication methods, token binding and server directions for this arrangement; it does not replace TLS or the rest of OAuth.
A familiar example
A photo app gets permission to fetch your pictures. Someone copies its token, but the picture service stops them because their connection cannot prove the same certificate. If the app renews its certificate, it needs a new bound token, even if it kept the same key.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Show a card, then prove you own its keyA photo app wants permission to fetch pictures. A public certificate can be copied; the secret private key must stay with its owner.→
- Match a trusted certificate to the app’s nameThe token issuer knows photo-app and expects one registered certificate subject. Check the issuer chain and that subject before accepting the app.→
- Match a certificate already on the guest listInstead of trusting an issuer chain, the server can keep this app’s exact certificate on a registered list. A self-signed card is not an automatic invitation.→
- Attach a certificate fingerprint to a tokenThe issuer gives the app an access token: a permission note. It attaches a short, computed fingerprint of the certificate used to obtain it.→
- Stop a copied token at the picture serviceThe picture service checks both the permission note and the certificate used on this connection. Copying the note alone should not open the gate.→
- A public app can still keep its token to itselfAn app without a registered login credential can prove it holds a particular key. Keep that distinction when it asks to replace an old access token.→
- Find the right door from the server’s directionsSome servers keep the door that asks for a client certificate separate from the ordinary token door. Follow the published directions rather than inventing an address.→
- Keep the proof trustworthy through a front deskA proxy may finish TLS before the request reaches the picture service. The service must know which certificate the proxy actually verified, rather than trusting a label sent by anyone.→
This introduction explains RFC 8705 (2020). Read the original RFC ↗