Mutual TLS (mTLS) can prove which client service presented a certificate and controls its private key; it does not, by itself, grant that service permission to use an API. The API’s resource server must still validate an access token and apply its authorization policy. When the token is certificate-bound, the server also checks that the caller presents the certificate tied to that token. These are related but distinct checks.
What mTLS proves
In mutual TLS, the client presents an X.509 certificate during the TLS handshake and proves possession of the private key corresponding to it. The server evaluates that certificate under its trust and configuration policy. This authenticates a client at the TLS layer; it is not a decision about what that client may do within an application. See the IETF’s TLS 1.3 specification and RFC 8705.
As an Amazon Associate I earn from qualifying purchases.
Authentication asks, “Which client proved control of a credential?” Authorization asks, “Which operations or resources may that authenticated client access?” A certificate can establish identity without specifying API methods, records, or actions the client is allowed to use.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What decides whether a service may use an API?
For OAuth-protected resources, the resource server makes its authorization decision based on the access token presented by the client, applying the token’s permissions and the application’s policy. RFC 8705, Section 6.2, puts it plainly: “The resource server makes authorization decisions based on the access token presented by the client but does not directly authenticate the client per se.”
#1 Best Overall
In practice, the request path can involve several separate checks. Which component performs each one depends on the architecture and policy:
- TLS peer check: the TLS endpoint validates the certificate and the client’s proof of its private key under local trust policy.
- OAuth client authentication: the authorization server authenticates the client if that endpoint’s configuration requires it.
- Token validation and authorization: the resource server validates the access token and enforces its permissions together with application policy.
- Certificate binding, if used: the resource server checks that the client certificate presented at the TLS layer matches the certificate associated with the token.
Calling all of these “mTLS authorization” obscures which component is responsible for granting or denying access.
What certificate-bound access tokens add
RFC 8705 defines certificate-bound access tokens as a way to tie token use to the holder of a particular certificate’s private key. The protected resource obtains the client certificate from its TLS layer and compares it with the certificate associated with the token. If they do not match, the resource server must reject the request.
Recommended Free Tools
This proof-of-possession check can help prevent someone who has stolen a token from replaying it without the corresponding private key. It does not add API permissions or replace the resource server’s authorization decision. The server still has to evaluate the token’s permissions and the applicable application policy.
OAuth mTLS client authentication and token binding are separate
RFC 8705 covers two related functions: using a client certificate to authenticate an OAuth client to an authorization server, and binding an issued access token to a certificate for later verification at a protected resource. They can be deployed independently or together. Whether an OAuth endpoint requires mTLS for client authentication is determined by its policy or configuration; using mTLS at that endpoint does not automatically mean issued tokens are certificate-bound.
For broader OAuth guidance, RFC 9700 recommends asymmetric cryptography for client authentication and names both mTLS and signed JWTs as examples. mTLS is therefore one option, not the only way to authenticate an OAuth client.
Rank #4
What changes when TLS ends at a proxy?
If a reverse proxy or load balancer terminates TLS, the backend application does not directly observe the original client’s TLS handshake. It may need certificate identity metadata from that intermediary to perform checks such as certificate-to-token binding.
RFC 8705 leaves the secure communication of client-certificate metadata from an intermediary to the application server to the deployment. The system must ensure that the metadata’s provenance and integrity are preserved across the proxy boundary; otherwise, the backend cannot safely treat it as the identity established by the original TLS connection.
Best Value
- Used Book in Good Condition
Keep server identity separate from client permissions
mTLS concerns certificate-based identity and proof of key possession at the TLS layer. It should not be confused with the resource server’s authorization of a client request. RFC 9525, Service Identity in TLS, provides context on verifying the identity of the server being contacted—a separate question from what an authenticated client may do at an application endpoint.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
