RFC 8705: OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

This document describes OAuth client authentication and certificate-bound access and refresh tokens using mutual Transport Layer Security (TLS) authentication…

Read RFC 8705 on the RFC Editor

Outgoing relationships (20 related RFCs)

Normative reference — RFC 2119: Key words for use in RFCs to Indicate Requirement Levels
Normative reference — RFC 8174: Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
Normative reference — RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
Normative reference — RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Normative reference — RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3
Normative reference — RFC 4648: The Base16, Base32, and Base64 Data Encodings
Normative reference — RFC 7519: JSON Web Token (JWT)
Normative reference — RFC 6749: The OAuth 2.0 Authorization Framework
Normative reference — RFC 7517: JSON Web Key (JWK)
Normative reference — RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
Normative reference — RFC 4514: Lightweight Directory Access Protocol (LDAP): String Representation of Distinguished Names
Normative reference — RFC 8414: OAuth 2.0 Authorization Server Metadata
Normative reference — RFC 7662: OAuth 2.0 Token Introspection
Normative reference — RFC 7591: OAuth 2.0 Dynamic Client Registration Protocol
Normative reference — RFC 7800: Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)
Informative reference — RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions
Informative reference — RFC 5952: A Recommendation for IPv6 Address Text Representation
Informative reference — RFC 7518: JSON Web Algorithms (JWA)
Informative reference — RFC 4517: Lightweight Directory Access Protocol (LDAP): Syntaxes and Matching Rules
Informative reference — RFC 7009: OAuth 2.0 Token Revocation

Incoming relationships (6 related RFCs)

Normatively referenced by — RFC 9201: Additional OAuth Parameters for Authentication and Authorization for Constrained Environments (ACE)
Normatively referenced by — RFC 9700: Best Current Practice for OAuth 2.0 Security
Normatively referenced by — RFC 9728: OAuth 2.0 Protected Resource Metadata
Informatively referenced by — RFC 9126: OAuth 2.0 Pushed Authorization Requests
Informatively referenced by — RFC 9440: Client-Cert HTTP Header Field
Informatively referenced by — RFC 9449: OAuth 2.0 Demonstrating Proof of Possession (DPoP)