Skip to main content

Mutual TLS (mTLS) Client Authentication

Mutual TLS (mTLS) client authentication enhances OAuth security by replacing shared client secrets with X.509 certificates, ensuring both the client and server authenticate at the TLS layer. This allows access tokens to be cryptographically bound to a specific client identity rather than treated as generic bearer tokens.

What mTLS Adds to OAuth​

In standard OAuth 2.0, TLS typically authenticates only the server, while the client uses a static credential (such as a client secret) to prove its identity. This secret can be exposed, reused, or phished. With mTLS, the client presents its certificate during the TLS handshake, establishing mutual authentication. The authorization server can then bind token issuance and validation to the presented certificate, as specified in RFC 8705.

mTLS Client Authentication Modes​

RFC 8705 defines two methods for client authentication using mTLS:

  • PKI-based mode – Trust is derived from a CA-signed certificate chain validated against a configured trust anchor.

  • Self-signed mode – Trust is established via a pre-registered public key, without reliance on a CA hierarchy.

The fundamental distinction lies in where trust is anchored—either in a PKI with standard certificate lifecycle management or in pre-provisioned key material controlled by the authorization server.

PKI-Based mTLS in Practice​

In PKI mode (the PKI-based mode described above, where trust is anchored in a CA-signed certificate chain), the client uses a certificate issued by a trusted CA. The authorization server validates:

  • The certificate chain against known CAs.

  • Revocation status (via CRL or OCSP).

  • Certificate subject or SAN attributes configured for that client registration.

During dynamic or static registration, the server stores expectations such as tls_client_auth_subject_dn or SAN-based fields (tls_client_auth_san_dns, tls_client_auth_san_uri, tls_client_auth_san_ip, tls_client_auth_san_email). At runtime, the presented certificate must match one of these registered attributes to successfully authenticate.

mTLS Authentication to Raidiam APIs​

Within the Raidiam Connect platform, client applications can be configured to use mutual TLS (mTLS) for client authentication. When mTLS is enabled, the client must present a valid X.509 certificate during the TLS handshake, allowing Connect to verify both the client's identity and the integrity of the connection.

Open Book IconTABLE OF CONTENT