What exactly does one do with an iss that has an HTTPS URL? Seems like we say two different things must happen.
I'm also fuzzy on where the x5c appears. Is it a claim that has the X509 certificate chain? More needs to be said about verification and construction for interoperability, probably through a few references. Sincerely, Watson _______________________________________________ OAuth mailing list -- oauth@ietf.org To unsubscribe send an email to oauth-le...@ietf.org
