Mutual-TLS Client Authentication and Certificate-Bound Tokens

Authenticates the client with a TLS client certificate and binds access tokens to that certificate.

Where it stands: Published RFC
Official text: RFC 8705
Documented support: 4
Activity: 0

No explainer written for this spec yet. The summary, relations and documented support below are maintained.

Authenticates the client with a TLS client certificate and binds access tokens to that certificate.

How it relates to other specs

Relations diagram

flowchart LR
  s_mtls["Mutual-TLS Client Authentication and Certificate-Bound Tokens"]
  s_oauth2["OAuth 2.0"]
  s_dpop["DPoP"]
  s_wimse_mtls["WIMSE Mutual TLS"]
  s_fapi2["FAPI 2.0 Security Profile"]
  style s_mtls stroke-width:3px
  s_mtls -->|Extends| s_oauth2
  s_dpop -.-|Alternative to| s_mtls
  s_wimse_mtls -->|Works with| s_mtls
  s_fapi2 -->|Builds on| s_mtls

Documented support

Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.

Products, identity providers and services

Auth0 (Identity provider): mTLS token binding (certificate-bound tokens), advertised in its discovery document source (verified 2026-11-11)

Open-source implementations

Spring Authorization Server (Library): tls_client_auth and self_signed_tls_client_auth client authentication (RFC 8705) source (verified 2026-11-11)
Duende IdentityServer (Library): RFC 8705 is listed in its supported specifications source (verified 2026-11-11)
node-oidc-provider (Library): RFC 8705 is in its list of implemented specs source (verified 2026-11-11)

Activity

Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.

Nothing collected about this spec yet.