Transport security for JWKS endpoints about standards-maintenance HOT 4 CLOSED

In the past ABA meetings it was verbally confirmed as TLS but the standards still mention MTLS. Can this be updated in the standards.

from standards-maintenance.

Commonwealth Bank supports Westpac’s proposal that TLS without mutual authentication on JWKS endpoints should be considered for February implementation.

from standards-maintenance.

Currently, the valid interpretation of the standards is that these end points are server to server and therefore MTLS is required.

This is, however, being discussed on a change proposal at: #43

from standards-maintenance.

Currently, the valid interpretation of the standards is that these end points are server to server and therefore MTLS is required.

This (requiring MTLS) represents a direct change to essentially all existing OIDC Client Discovery libraries.

This is, however, being discussed on a change proposal at: #43

This is a confusing linkage. JWKS endpoints are OIDC, #43 relates to CDR specific endpoints. The former has many existing implementations impacted (as per above), the latter is CDR specific so backlog items aren't really impacted because it's likely TLS/MTLS setup will occur in Participant software.

from standards-maintenance.