Mutual Transport Layer Security (mTLS) is a TLS configuration in which the server and client authenticate each other with certificates. During the handshake, the client sends a public certificate and proves ownership by signing a message with its private key. This helps prevent a stolen access token from being used by an attacker who lacks the legitimate client certificate. section 7.5.1 section 7.5
Figure 7.12 MTLS requires the client (such as a browser) to provide its own certificate to verify its identity.
Use the handshake illustration to see how the client certificate adds client authentication to ordinary TLS. section 7.5.1
For OAuth, mTLS binds an access token to a specific client certificate. The authorization server records the certificate details, derives a thumbprint, and places it in the token’s cnf confirmation claim. A client must therefore present the corresponding certificate when using the token. section 7.5.1 section 7.8
Certificate-bound JWT
A JWT can carry a cnf claim containing an x5t#S256 value: {"cnf":{"x5t#S256":"bwcK0esc3ACC3DB2Y5_lESsXE8o9ltc05O89jdN-dg2"}}. The value identifies the client certificate bound to the token. section 7.5.1
