Tag: mTLS

Using mutual TLS with OAuth 2.0 (RFC 8705): certificate-based client authentication and certificate-bound access tokens that make stolen tokens useless.

• Certificate-Bound Access Tokens: How mTLS Makes Stolen Tokens Useless

  26 Apr, 2025

  • 9 min read

  Bearer tokens are usable by anyone who possesses them. Certificate-bound tokens, defined in RFC 8705, bind the access token to the client certificate used in the mTLS handshake, so even if a token is intercepted, it's cryptographically worthless without the matching certificate.

• mTLS for OAuth2 Client Authentication: A Stronger Alternative to Shared Secrets

  25 Apr, 2025

  • 13 min read

  Shared secrets can be stolen, leaked, or brute-forced. mTLS-based client authentication uses certificates to prove private key possession. Learn how to apply TLS handshake–based authentication to meet OAuth 2.0 client authentication requirements.