What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

If a Client A wants to gain access on a protected resource hosted by some other Entity B, then wants an access token from the authorization server. Most specifically it "talks" to the token endpoint of the authorization server.

But also the entity that gives the protected resource to the client cannot considered as an endpoint?

i am confused here.


The endpoint of a network communication is the computer, program, or function which initiates or ultimately receives the communication. Since TLS is "designed to establish a secure connection between a client and a server communicating over an insecure channel" (RFC 5246), it's probably safe to assume the paper you linked to is talking about client & server endpoints.

So, without endpoints, TLS itself would have no purpose. I think that's the best your question can be answered.

  • i edit my question above to make more sense – loutsi1 Dec 21 '20 at 18:37
  • Yes, client + authorization server and client + resource owner are both valid endpoint pairs. Is there a particular passage in the paper where the term needs further clarification? – Noah Dec 21 '20 at 20:25
  • Is your question something like, "Why should the client perform mutual TLS with just the authorization server when it can do it with the resource server instead/also?" – Noah Dec 21 '20 at 20:47
  • thank you for the answer. My confusion is the following. We have an endpoint which is the part that holds the protected resource. Also, auth server has a token endpoint. But I am reading from here docs.oracle.com/en/cloud/get-started/subscriptions-cloud/ocuid/… that " An endpoint is typically a URI on a web server, but OAuth endpoints are the URLs that you use to make OAuth authentication requests. So the token endpoint in auth server is a URL? Also, the authorization endpoint is located in auth server on the protected resource? – loutsi1 Dec 21 '20 at 20:53
  • also, I would like to here the answer in the above statement "Why should the client perform mutual TLS with just the authorization server when it can do it with the resource server instead/also? because is something that I am interested to know – loutsi1 Dec 21 '20 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.