Method The same method as the request that was made to the service URL that responded with the challenge (from section ) URL The same URL as the service URL that responded with the challenge (from section 3.1.5.1.1) Header: "Authorization" PKeyAuth AuthToken="<Signed-JWT>", Context="[Thumbprint based certificate challenge].ServerContext" Signed-JWT: A Client Token (section ) that was generated and signed using JWS, as specified in the processing details (section ). Response See section . Processing Details The client processes the server's certificate challenge in the following manner. The client converts the server's challenge into a [Thumbprint based certificate challenge] as follows. [Thumbprint based certificate challenge] name Value CertThumbprint <cert-thumbprint> (section ) ServerContext <Server-state> (section 3.2.5.2.2) (section 3.2.5.2.2) The client forms a Client Token (section ) with the following attributes. Client Token Value aud The same URL as the service URL that responded with the challenge (from section ) iat The current timestamp as described in section 2.2.1.1 nonce [Thumbprint certificate challenge].Nonce The Client that was generated in step 2 is signed using JWS with an X509 certificate. The certificate MUST have the same X509-certificate thumbprint as specified in [Thumbprint based certificate challenge].CertThumbprint. During signing, JWS headers, as defined in Client Token JWS Headers (section ), MUST be used. The content that was obtained in step 3 is used as the <Signed-JWT> value in the request that is defined in section . If the client does not have possession of the private key of an X509 certificate whose thumbprint matches [Thumbprint based certificate challenge].CertThumbprint, the client MUST omit the AuthToken parameter from the request that is specified in section 3.1.5.3.1.
Method The same method as the request that was made to the service URL that responded with the challenge (from section ) URL The same URL as the service URL that responded with the challenge (from section 3.1.5.1.1) Header: "Authorization" PKeyAuth AuthToken="<Signed-JWT>", Context="[Thumbprint based certificate challenge].ServerContext" Signed-JWT: A Client Token (section ) that was generated and signed using JWS, as specified in the processing details (section ). Response See section . Processing Details The client processes the server's certificate challenge in the following manner. The client converts the server's challenge into a [Thumbprint based certificate challenge] as follows. [Thumbprint based certificate challenge] name Value CertThumbprint <cert-thumbprint> (section ) ServerContext <Server-state> (section 3.2.5.2.2) (section 3.2.5.2.2) The client forms a Client Token (section ) with the following attributes. Client Token Value aud The same URL as the service URL that responded with the challenge (from section ) iat The current timestamp as described in section 2.2.1.1 nonce [Thumbprint certificate challenge].Nonce The Client that was generated in step 2 is signed using JWS with an X509 certificate. The certificate MUST have the same X509-certificate thumbprint as specified in [Thumbprint based certificate challenge].CertThumbprint. During signing, JWS headers, as defined in Client Token JWS Headers (section ), MUST be used. The content that was obtained in step 3 is used as the <Signed-JWT> value in the request that is defined in section . If the client does not have possession of the private key of an X509 certificate whose thumbprint matches [Thumbprint based certificate challenge].CertThumbprint, the client MUST omit the AuthToken parameter from the request that is specified in section 3.1.5.3.1.