Subject: [OAUTH-WG] key vs. cert fingerprint in -security-topics-13

From: Brian Campbell <[email-masked]>
Date: Mon, 23 Dec 2019 16:36:12 -0700

The description of OAuth Mutual TLS in
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-4.8.1.2
says the "client is identified towards the resource server by the
fingerprint of its public key" but it's actually a fingerprint/hash of the
certificate not the public key. See
https://tools.ietf.org/html/draft-ietf-oauth-mtls-17#section-3.1 for
example.

-- 
_CONFIDENTIALITY NOTICE: This email may contain confidential and privileged 
material for the sole use of the intended recipient(s). Any review, use, 
distribution or disclosure by others is strictly prohibited.  If you have 
received this communication in error, please notify the sender immediately 
by e-mail and delete the message and any file attachments from your 
computer. Thank you._