<html class="apple-mail-supports-explicit-dark-mode"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Hi Ralph,<div><br></div><div><div>Thanks for the thoughtful feedback. </div><div><br></div><div>I agree that introducing a parallel schema may risk fragmentation. I’d like to explore reframing TADR as a JWKS profile focused on trust anchor rotation — building on existing mechanisms like x5c, x5dn, and signed JWKS bundles. </div><div><br></div><div>I believe there’s still value in defining client behavior and rotation semantics explicitly. </div><div><br></div><div>I’ll revise the draft accordingly and welcome collaboration from those who’ve implemented similar patterns in Brazil, UK, or elsewhere.</div><div><div dir="ltr"><div class="sh-color-black sh-color"><div class="sh-color-black sh-color"><div class="sh-color-black sh-color"><div class="sh-color-black sh-color"><div class="sh-color-black sh-color"><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);">Cordially, </span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);">Rahul Khanna | Sr Principal Consultant</span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);">Propensic Solutions, LLC</span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);">Call/Text <b class="sh-color-black sh-color"><font class="sh-color-orange sh-color">(new)</font></b>: <a href="tel:+1-813-330-0677" value="+15408469195" target="_blank" rel="noopener noreferrer" class="sh-color-blue sh-color">+1-813-330-0677</a> (USA East Coast)</span></div><div class="sh-color-black sh-color"><span class="sh-modified-inline sh-color sh-color-black" sh-original-style="background-color:rgba(255,255,255,0)" style="background-color: rgba(255, 255, 255, 0);">Email: <a href="mailto:rkhanna@propensic.com" target="_blank" rel="noopener noreferrer" class="sh-color-blue sh-color">rkhanna@<wbr>propensic.<wbr>com</a></span></div></div></div><div class="sh-color-black sh-color"><span style="background-color: rgba(255, 255, 255, 0);">Want to meet? <a href="https://calendar.app.google/Z3LJkWBT6v5KM4tL6" target="_blank" rel="noopener noreferrer" class="sh-color-blue sh-color">Schedule a meeting today!</a></span></div><div class="sh-color-black sh-color"><span style="background-color: rgba(255, 255, 255, 0);">Visit us online: <a href="http://www.propensic.com/" target="_blank" rel="noopener noreferrer" class="sh-color-blue sh-color">www.<wbr>propensic.<wbr>com</a></span></div></div></div></div><div class="sh-color-black sh-color"><span style="background-color: rgba(255, 255, 255, 0);"></span></div></div><div dir="ltr"><br><blockquote type="cite">On Oct 26, 2025, at 10:44 PM, Ralph Bragg <ralph.bragg@raidiam.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p dir="ltr" class="p1" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Hi Rahul,</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">I’ve reviewed the TADR draft and, while I agree with the premise that automation around trust-anchor
rotation is becoming critical, I don’t see a case for introducing a parallel discovery field or schema when JWKS already supports or could be extended to support these functions.</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The issues raised are not new — they’ve already been solved in production ecosystems using the existing
JWKS and Discovery patterns defined in RFC 7517 and RFC 8414.</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Looking at your requirements and what we can do with JWKS:</span></p>
<ul style="text-align: left;">
<li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Discovery and distribution are already covered by jwks_uri. It’s the standard endpoint for publishing verifiable keys and
<b>certificates</b>. If there’s a need to distinguish between signing and transport anchors, a profile or attribute could be introduced rather than defining a new endpoint.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Certificate representation is fully supported via x5c, x5t, and x5u. Additional metadata such as subject, issuer, or validity can be derived from the certificate itself or exposed as lightweight extensions (e.g., x5dn in Open
Banking Brazil for correlation - (which I still need to get around to registering)).</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Integrity is already supported. A JWKS can be distributed as a signed JWS or encapsulated in an OpenID Federation entity statement, providing cryptographic assurance without defining a new format.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Rotation is a solved problem. Multiple JWK entries (each with their own kid) allow overlapping validity and seamless rollover for signing and transport certificates.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Transport certificates are handled the same way. In Brazil, the x5dn extension allows correlation between successive certificates with the same DN. When a server’s leaf certificate expires, it’s simply replaced in the JWKS
— clients parse and process it automatically.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">Trust-anchor rotation (actual CA changes) can also be represented via x5c — Brazil’s directory publishes the trust list in both PEM and JWKS formats.</p>
</li></ul>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The so-called “bootstrap trust” problem exists in every model — including TADR. To fetch any endpoint
securely, you already rely on an existing trust list. Introducing a trust_anchor_uri doesn’t solve that dependency as the endpoint is still served over https!</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">From an implementation standpoint, TADR appears to re-model a certificate as JSON rather than reuse
the already defined and deployed mechanism that does exactly this. Everything described in the draft could be achieved today using JWKS and, if desired, additional x5x attributes to enrich the metadata.</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">In short:</span></p>
<ul style="text-align: left;">
<li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">If it’s about signing keys, publish them in the JWKS and rotate as normal.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">If it’s about transport (mTLS) certificates, continue to use JWKS with x5c and x5dn.</p>
</li><li style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p class="p1" role="presentation">If it’s about trust anchors, use the same structure — that’s exactly what x5c was designed for.</p>
</li></ul>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Given the maturity, extensibility, and interoperability of JWKS across deployed OpenID ecosystems
(UK, Brazil, UAE), I’d strongly suggest we extend JWKS or issue implementation guidance rather than create a second, parallel mechanism that risks fragmentation.</span></p>
<p class="p2" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Regards,</span></p>
<p class="p4" style="text-align: left; text-indent: 0px;"><span style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Ralph Bragg</span></p>
<div dir="ltr" style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="ms-outlook-mobile-signature" style="color: inherit; background-color: inherit;">
<div contenteditable="false" style="color: inherit; background-color: inherit;">
<table cellpadding="0" cellspacing="0" style="height:64.33px;border-collapse:unset;padding:0px;">
<tbody>
<tr>
<td align="left" height="16.67" nowrap="nowrap" style="height:16.67px;vertical-align:top;white-space:nowrap;padding:0px 0px 2px;border-collapse:collapse;" valign="top">
<table style="border-collapse:collapse;">
<tbody>
<tr>
<td style="padding:0px;">
<p style="line-height:14.67px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 11pt; font-weight: bold;">Ralph Bragg</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td align="left" height="15.33" nowrap="nowrap" style="height:15.33px;vertical-align:top;white-space:nowrap;padding:0px 0px 5px;border-collapse:collapse;" valign="top">
<table style="border-collapse:collapse;">
<tbody>
<tr>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt; font-weight: bold;">Chief Technology Officer</span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td align="left" height="15.33" style="height:15.33px;vertical-align:top;padding:0px;" valign="top">
<table cellpadding="0" cellspacing="0" style="height:15.33px;">
<tbody>
<tr>
<td align="left" height="15.33" nowrap="nowrap" style="height:15.33px;vertical-align:bottom;white-space:nowrap;padding:0px 10px 0px 0px;border-collapse:collapse;" valign="bottom">
<table style="border-collapse:collapse;">
<tbody>
<tr>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;">M.</span></p>
</td>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;"> </span></p>
</td>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;">+447890130559</span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td align="left" height="15.33" nowrap="nowrap" style="height:15.33px;vertical-align:bottom;white-space:nowrap;padding:0px 0px 0px 2.67px;border-collapse:collapse;" valign="bottom">
<table style="border-collapse:collapse;">
<tbody>
<tr>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;">T.</span></p>
</td>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;"> </span></p>
</td>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt;">+44 20 4583 6770</span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td align="left" height="15.33" nowrap="nowrap" style="height:15.33px;vertical-align:bottom;white-space:nowrap;padding:0px 0px 0px 10px;border-collapse:collapse;" valign="bottom">
<table style="border-collapse:collapse;">
<tbody>
<tr>
<td style="padding:0px;">
<p style="line-height:13.33px;margin:0.1pt;"><a href="mailto:ralph.bragg@raidiam.com" style="text-decoration: none;"><span style="font-family: Tahoma, Verdana, Segoe, sans-serif; font-size: 10pt; text-decoration: none;">ralph.bragg@raidiam.com</span></a></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td height="10" style="width:470px;height:10px;padding:0px;">
<p style="line-height:0;margin:0.1pt;padding:0px;width:100%;height:10px;"></p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="mail-editor-reference-message-container" style="color: inherit; background-color: inherit;">
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing"></div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
From: Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net> on behalf of Rahul Khanna via Openid-specs-ab <openid-specs-ab@lists.openid.net><br>
Date: Monday, 27 October 2025 at 9:39 am<br>
To: openid-specs-ab@lists.openid.net <openid-specs-ab@lists.openid.net><br>
Cc: Rahul Khanna <rkhanna@propensic.com><br>
Subject: [Openid-specs-ab] Peer review request: TADR draft<br>
<br>
</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing">Hello esteemed community,<br>
<br>
I would like to propose Draft 00 of the Trust Anchor Distribution & Rotation (TADR) specification for consideration by the OpenID Connect AB Working Group.<br>
<br>
Given that issuers already expose `.well-known/openid-configuration` metadata, this registry is a natural place to address the CA/B Forum’s decision to shorten TLS certificate lifetimes to just 47 days by 2029. This industry shift makes manual trust anchor
management unsustainable — automation and interoperability are now mission‑critical, particularly for OAuth client apps, OIDC Client Credential Flows, and potential future extensions such as agentic AI authentication/authorization.<br>
<br>
What TADR proposes: </div>
<ul dir="ltr">
<li dir="ltr">A new `trust_anchor_uri` in OIDC Discovery </li><li dir="ltr">A standardized JSON schema for trust anchor bundles </li><li dir="ltr">Clear client behaviors for fetching, caching, and rotating anchors </li><li dir="ltr">Reference implementations (Node.js server + Python client) to prove feasibility </li></ul>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing"><br>
Why it matters: </div>
<ul dir="ltr">
<li dir="ltr">Prevents outages during certificate rotation </li><li dir="ltr">Aligns OIDC ecosystems with the short‑lived certificate era </li><li dir="ltr">Strengthens distributed trust and resilience across federated identity </li></ul>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing"><br>
This is just Draft 00 — the beginning of a conversation. I’m excited to collaborate with the OpenID Foundation community, PKI experts, and identity architects to refine and advance this work.<br>
<br>
The draft and reference implementations are available in the working group repository branch `<a href="https://github.com/openid/publication/pull/122/commits/8ef96f263a9c791a7b3c4130d022132a1f099dfa" target="_blank" originalsrc="https://github.com/openid/publication/pull/122/commits/8ef96f263a9c791a7b3c4130d022132a1f099dfa" data-outlook-id="b47e3722-69d9-407d-8fb5-815f1f078502">propose/connect/openid-tadr-1_0-00</a>`.<br>
<br>
I welcome guidance on the correct submission process and look forward to your feedback.<br>
<br>
Thank you!</div>
<div dir="ltr" class="ms-outlook-mobile-reference-message skipProofing"><br>
</div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);">Cordially, </span></div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);"><br>
</span></div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);">Rahul Khanna | Sr Principal Consultant</span></div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);">Propensic Solutions, LLC</span></div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);">Call/Text
</span><span style="color: rgb(255, 153, 0); background-color: rgba(255, 255, 255, 0);">(new)</span><span style="background-color: rgba(255, 255, 255, 0);">:
</span><span style="color: rgb(17, 85, 204); background-color: rgba(255, 255, 255, 0);"><a href="tel:+1-813-330-0677" target="_blank" data-outlook-id="db10777f-50d6-4ab9-a7a6-713b306a2189" style="color: rgb(17, 85, 204);">+1-813-330-0677</a></span><span style="background-color: rgba(255, 255, 255, 0);"> (USA
East Coast)</span></div>
<div dir="ltr" class="gmail_signature"><span style="background-color: rgba(255, 255, 255, 0);">Email:
</span><span style="color: rgb(17, 85, 204); background-color: rgba(255, 255, 255, 0);"><a href="mailto:rkhanna@propensic.com" target="_blank" data-outlook-id="c8099594-86d3-478c-98e4-fa7be78a7d26" style="color: rgb(17, 85, 204);">rkhanna@propensic.com</a></span></div>
<div dir="ltr" class="gmail_signature">Want to meet? <a href="https://calendar.app.google/Z3LJkWBT6v5KM4tL6" target="_blank" originalsrc="https://calendar.app.google/Z3LJkWBT6v5KM4tL6" data-outlook-id="8dfe75ab-2f22-4fa1-8073-0972d7c3bc4d">
Schedule a meeting today!</a></div>
<div dir="ltr" class="gmail_signature">Visit us online: <a href="http://www.propensic.com/" target="_blank" originalsrc="http://www.propensic.com/" data-outlook-id="63d91578-0856-4420-8d85-e547915ae883">
www.propensic.com</a></div>
<div dir="ltr" class="gmail_signature"><br>
</div>
</div>
</div></blockquote></div></div></body></html>