Identity Deep Dive

WIMSE Mutual TLS

Workload-to-workload authentication at the transport layer with Workload Identity Certificates.

Where it stands
Working-group draft
Official text
draft-ietf-wimse-mutual-tls-03
2026-10-30
Documented support
0
Activity
2 signals in 90 days

No explainer written for this spec yet. The summary, relations and documented support below are maintained.

Workload-to-workload authentication at the transport layer with Workload Identity Certificates.

How it relates to other specs

Relations diagram
flowchart LR
  s_wimse_mtls["WIMSE Mutual TLS"]
  s_wimse_creds["WIMSE Workload Credentials"]
  s_mtls["Mutual-TLS Client Authentication and Certificate-Bound Tokens"]
  style s_wimse_mtls stroke-width:3px
  s_wimse_mtls -->|Builds on| s_wimse_creds
  s_wimse_mtls -->|Works with| s_mtls

Documented support

Adoption lists only support stated in official documentation (the vendor's or project's own, or a standards body's page naming it), and a weekly check confirms the cited phrase is still on that page. Experimental, alpha and beta support is counted separately as preview.

No sourced support entries collected yet. This says nothing about how widely it is used.

Activity

Revisions from the Datatracker, explanations from this site's daily runs, and mailing-list subjects naming the draft.

Explanations on this site

  • DiscussionIETF WIMSE

    Kathleen's review of the mTLS draft asks it to cover key-pair authentication, not just path validation and naming, and thinks WGLC is possible.

    Review of https://datatracker.ietf.org/doc/draft-ietf-wimse-mutual-tls/

    Read the explanation

    The review proposes adding at the transport layer to the first sentence of the Introduction. It suggests a new section before 3.2 on authenticating the workload with the key pair tied to the certificate, including provisioning when the workload must match expected key pairs. In Section 5.1 it proposes wording so the server is authenticated using its credentials and key pair, not only the workload identity name. It also proposes that a server doing mTLS MUST validate the client certificate chain and key pair, as well as trust domain and Workload Identifier. With these changes the reviewer sees WGLC as possible.

    • An mTLS implementer who wants the spec to say explicitly that proof of possession of the certificate key is part of authentication, alongside chain and identifier checks.

On the mailing list