What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens

If a Client A wants to gain access on a protected resource hosted by some other Entity B, then wants an access token from the authorization server. Most specifically it "talks" to the token endpoint of the authorization server.

But also the entity that gives the protected resource to the client cannot considered as an endpoint?

i am confused here.

1 Answer 1


The endpoint of a network communication is the computer, program, or function which initiates or ultimately receives the communication. Since TLS is "designed to establish a secure connection between a client and a server communicating over an insecure channel" (RFC 5246), it's probably safe to assume the paper you linked to is talking about client & server endpoints.

So, without endpoints, TLS itself would have no purpose. I think that's the best your question can be answered.

  • i edit my question above to make more sense
    – loutsi1
    Dec 21, 2020 at 18:37
  • Yes, client + authorization server and client + resource owner are both valid endpoint pairs. Is there a particular passage in the paper where the term needs further clarification?
    – Noah
    Dec 21, 2020 at 20:25
  • Is your question something like, "Why should the client perform mutual TLS with just the authorization server when it can do it with the resource server instead/also?"
    – Noah
    Dec 21, 2020 at 20:47
  • thank you for the answer. My confusion is the following. We have an endpoint which is the part that holds the protected resource. Also, auth server has a token endpoint. But I am reading from here docs.oracle.com/en/cloud/get-started/subscriptions-cloud/ocuid/… that " An endpoint is typically a URI on a web server, but OAuth endpoints are the URLs that you use to make OAuth authentication requests. So the token endpoint in auth server is a URL? Also, the authorization endpoint is located in auth server on the protected resource?
    – loutsi1
    Dec 21, 2020 at 20:53
  • also, I would like to here the answer in the above statement "Why should the client perform mutual TLS with just the authorization server when it can do it with the resource server instead/also? because is something that I am interested to know
    – loutsi1
    Dec 21, 2020 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .