← All practicals

Bind a token to a certificate (mTLS)

Issue a token bound to a client cert, then present a different one and watch access refuse it.

1. 1

   On the mTLS lab, pick a sample client certificate and issue a bound token.

   The token carries a cnf.x5t#S256 claim — the base64url SHA-256 thumbprint of that certificate’s DER bytes (RFC 8705) — computed once, at issue time.

2. 2

   Access the resource presenting the SAME certificate.

   The resource server re-hashes the presented cert and compares it to the token’s cnf claim — a match is the ENTIRE access decision, and it succeeds.

3. 3

   Now access the resource again, presenting a DIFFERENT sample certificate (or none).

   The thumbprints no longer match, so access is refused with cert_binding_failed — a stolen bearer copy of this token is useless without the matching certificate.