From d4fe7042b1d49e7203e8afdb5028caff2ed7e2ea Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 3 Jul 2026 12:41:27 +0200
Subject: [PATCH 01/35] feat(bosh): add uaa.mtls_enabled property and update
 BOSH job spec

---
 jobs/uaa/spec                         | 12 ++++++++++--
 jobs/uaa/templates/config/uaa.yml.erb |  4 ++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/jobs/uaa/spec b/jobs/uaa/spec
index cc4ae2836..08fdfc69d 100644
--- a/jobs/uaa/spec
+++ b/jobs/uaa/spec
@@ -1304,8 +1304,16 @@ properties:
       BTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAL5j1JCN5EoXMOOBSBUL8KeVZFQD3Nfy
       YkYKBatFEKdBFlAKLBdG+5KzE7sTYesn7EzBISHXFz3DhdK2tg+IF1DeSFVmFl2n
       iVxQ1sYjo4kCugHBsWo+MpFH9VBLFzsMlP3eIDuVKe8aPXFKYCGhctZEJdQTKlja
-      lshe50nayKrT
-      -----END CERTIFICATE----
+            lshe50nayKrT
+            -----END CERTIFICATE----
+
+  uaa.mtls_enabled:
+    description: "Enable the RFC 8705 mTLS token endpoint at uaa.mtls_endpoint_path. Requires Gorouter forwarded_client_cert: sanitize_set."
+    default: false
+
+  uaa.mtls_endpoint_path:
+    description: "Path for the mTLS token endpoint"
+    default: "/oauth/mtls/token"
   login.saml.providers:
     description: |
       Contains a hash of SAML Identity Providers,
diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index 2ef225569..e1aa072d1 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -879,3 +879,7 @@
 
 %>
 <%= render(params) %>
+<% if p("uaa.mtls_enabled") %>
+mtls:
+  endpoint: <%= p("uaa.mtls_endpoint_path") %>
+<% end %>

From f2285e6938137b4aa1237a54fcaf2ba12b2bbaa0 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 3 Jul 2026 13:24:01 +0200
Subject: [PATCH 02/35] erb: skip secret validation for tls_client_auth and
 private_key_jwt clients

Clients using certificate-based or JWT-based authentication do not have
a client_secret. The template previously only exempted 'implicit' grant
type from the secret-required check; extend the exemption to
token-endpoint-auth-method tls_client_auth and private_key_jwt.
---
 jobs/uaa/templates/config/uaa.yml.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index e1aa072d1..0b4e12e2f 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -380,7 +380,7 @@
       if is_missing(client_data, 'authorized-grant-types')
         message = message + "\nMissing property: uaa.clients.#{id}.authorized-grant-types"
       else
-        message = message + "\nMissing property: uaa.clients.#{id}.secret" if client_data['secret'].nil? && client_data['authorized-grant-types'] != 'implicit'
+        message = message + "\nMissing property: uaa.clients.#{id}.secret" if client_data['secret'].nil? && client_data['authorized-grant-types'] != 'implicit' && client_data['token-endpoint-auth-method'] != 'tls_client_auth' && client_data['token-endpoint-auth-method'] != 'private_key_jwt'
         if (client_data['redirect-uri'].nil? || client_data['redirect-uri'].empty?)
           message = message + "\nMissing property: uaa.clients.#{id}.redirect-uri" if client_data['authorized-grant-types'] =~ /implicit|authorization_code/
         elsif client_data['redirect-uri'].split(',').any? { |uri| !(uri =~ /^http(\*|s)?:\/\/(.*:.*@)?(([a-zA-Z0-9\-\*]+\.)*[a-zA-Z0-9\-]+\.)?[a-zA-Z0-9\-]+(:[0-9]+)?(\/.*|$)/) }

From 5573b919bb28f8f1d303afc4b7851d7c25c9d1db Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 3 Jul 2026 17:20:27 +0200
Subject: [PATCH 03/35] Bump UAA submodule to feat/rfc8705-mtls-client-auth

Update UAA submodule to include the RFC 8705 mTLS implementation.

The submodule now points to the tip of the feat/rfc8705-mtls-client-auth
branch in cloudfoundry/uaa, which adds mutual-TLS client authentication
support for /oauth/mtls/token.
---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 5d42e16ae..cf49990e6 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 5d42e16ae2771a80f5e8818125e971d3b56cd09f
+Subproject commit cf49990e6f9303dc3cb29c7ef35e2363731433e8

From 1c403d9ff4a2a831485e793cceabaa718dcfd573 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 6 Jul 2026 09:48:11 +0200
Subject: [PATCH 04/35] Bump UAA submodule to fix(review): address PR feedback
 on mTLS client auth (2f77a0b)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index cf49990e6..2f77a0bb7 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit cf49990e6f9303dc3cb29c7ef35e2363731433e8
+Subproject commit 2f77a0bb7e7def89619cedc32697805fc4494fc6

From 05e4a5c7c488b422e7838f933c5e69a9d99c5939 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 6 Jul 2026 13:11:07 +0200
Subject: [PATCH 05/35] Bump UAA submodule: fix OIDC discovery test failures
 (5438939)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 2f77a0bb7..543893925 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 2f77a0bb7e7def89619cedc32697805fc4494fc6
+Subproject commit 54389392504582e2aa29d042f3a1f48a9940d126

From 5278a780a7173afcde1a7be489d84d2eb150daf0 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 6 Jul 2026 17:18:38 +0200
Subject: [PATCH 06/35] bump uaa submodule to 2856a5d (fix JsonProperty
 collision + full cert chain)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 543893925..2856a5dbd 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 54389392504582e2aa29d042f3a1f48a9940d126
+Subproject commit 2856a5dbd094ae187d2ae082b3acfa8130ddf6b7

From 43a1fd41ba8226d738f6ab6a626d0cf18cdad64d Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Tue, 7 Jul 2026 08:13:57 +0200
Subject: [PATCH 07/35] bump uaa submodule to 864e086 (fix test for @JsonIgnore
 round-trip)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 2856a5dbd..864e086a4 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 2856a5dbd094ae187d2ae082b3acfa8130ddf6b7
+Subproject commit 864e086a47d614471f754ec47bf250bcbe0ef181

From 43801d0b4ed321b3cb865de72218dde7816b2f24 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Tue, 7 Jul 2026 13:07:44 +0200
Subject: [PATCH 08/35] =?UTF-8?q?bump=20uaa=20submodule=20to=200513c60=20(?=
 =?UTF-8?q?feat:=20configurable=20token=20shape=20=E2=80=94=20sub/aud=20te?=
 =?UTF-8?q?mplates)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 864e086a4..0513c606d 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 864e086a47d614471f754ec47bf250bcbe0ef181
+Subproject commit 0513c606d54d9bb186d315261e5224313c73930e

From d1269dfc97c2085ee063002c0596050cec6a8e13 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Tue, 7 Jul 2026 14:39:58 +0200
Subject: [PATCH 09/35] bump uaa submodule to 98c09ab (fix: token enhancer
 sub/aud wins over UAA defaults)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 0513c606d..98c09abfd 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 0513c606d54d9bb186d315261e5224313c73930e
+Subproject commit 98c09abfdbd7ccea75bb24e64e555f4903358a2d

From 271df7fcc442651db12e7710e951784b361f0abd Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 19 Aug 2026 10:18:31 +0200
Subject: [PATCH 10/35] feat(uaa-release): expose uaa.mtls_enabled as a plain
 Spring property

---
 jobs/uaa/templates/config/uaa.yml.erb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index 0b4e12e2f..107ce7ac8 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -653,6 +653,7 @@
         'sleep' => p('uaa.shutdown.sleep')
       },
       'url' => uaa_base,
+      'mtls-enabled' => p('uaa.mtls_enabled'),
       'limitedFunctionality' => {
         'statusFile' => p('uaa.limitedFunctionality.statusFile'),
         'whitelist' => {

From 629839d268fd67d894b151111c404c5f2e3d6452 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 19 Aug 2026 15:42:49 +0200
Subject: [PATCH 11/35] chore: update uaa submodule pointer for RFC 8705
 trusted-proxy mTLS verification (Tasks 9-11)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 98c09abfd..febb3282f 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 98c09abfdbd7ccea75bb24e64e555f4903358a2d
+Subproject commit febb3282f1e20c850c1b5b3e7d8927e944a87a4e

From 2ff2664a4d6b7b72f54c897521c891de025b70a7 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 19 Aug 2026 16:18:26 +0200
Subject: [PATCH 12/35] chore: update uaa submodule pointer (TLS 1.3 JSSE PHA
 workaround)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index febb3282f..949c82975 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit febb3282f1e20c850c1b5b3e7d8927e944a87a4e
+Subproject commit 949c82975a61d32d1033ec088daaac91863ff7f7

From ce878b8f2b3fdfad0568aa6e9cd0b64d34ab00da Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 19 Aug 2026 17:01:27 +0200
Subject: [PATCH 13/35] chore: update uaa submodule pointer (fix
 CertificateRequest CA-list advertisement)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 949c82975..63b1df648 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 949c82975a61d32d1033ec088daaac91863ff7f7
+Subproject commit 63b1df64853de039fe7af5e98810dd874b3735ac

From bdbe6ce4a777d09721ef115e9157f9e0473d515f Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 19 Aug 2026 17:31:52 +0200
Subject: [PATCH 14/35] chore: update uaa submodule pointer (final
 coherence-review doc fix)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 63b1df648..28d2b8287 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 63b1df64853de039fe7af5e98810dd874b3735ac
+Subproject commit 28d2b82875cb8174f35566626a81a460de0775be

From 062b21fcd98d6594090fc2bf9865a0c921de67b8 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Thu, 20 Aug 2026 12:53:58 +0200
Subject: [PATCH 15/35] chore: update uaa submodule (TLS 1.3 mTLS via FIPS
 BCJSSE)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 28d2b8287..7496ce8c2 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 28d2b82875cb8174f35566626a81a460de0775be
+Subproject commit 7496ce8c2e7b5048277a70b0927d26a8e36cacf1

From 9f7595b2011aaa48988026e580b200ae97e4715b Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Thu, 20 Aug 2026 17:55:18 +0200
Subject: [PATCH 16/35] chore: update uaa submodule pointer (trusted-proxy-ca
 strict path separation)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 7496ce8c2..29103f0f4 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 7496ce8c2e7b5048277a70b0927d26a8e36cacf1
+Subproject commit 29103f0f414d7dfc81e5b0a468c883629ee779fb

From fc99144054f0c5b5970388b9b96bbec82f786249 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 08:24:24 +0200
Subject: [PATCH 17/35] chore: update uaa submodule pointer (merge develop,
 resolve conflicts)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 29103f0f4..d2175c0be 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 29103f0f414d7dfc81e5b0a468c883629ee779fb
+Subproject commit d2175c0be8187b963797974795fbfe6bd8766452

From 023f73223b5b65d45129eee875877a6c6de8defb Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 12:27:46 +0200
Subject: [PATCH 18/35] chore: update uaa submodule pointer
 (tls-client-auth-required-claims)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index d2175c0be..4a772df66 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit d2175c0be8187b963797974795fbfe6bd8766452
+Subproject commit 4a772df6652704c69d59f6fb705043de8aebad25

From d7c525dee3a163ff0edd4611ca55a414f4d71593 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 13:34:08 +0200
Subject: [PATCH 19/35] chore: update uaa submodule pointer (XFCC
 mapper-failure fix)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 4a772df66..5b63fdd64 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 4a772df6652704c69d59f6fb705043de8aebad25
+Subproject commit 5b63fdd64a91c38f45578a13b061077d0cd389ba

From 815553a978200ba30e6cf3f4c4143d243e1a0bde Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 14:32:53 +0200
Subject: [PATCH 20/35] chore: update uaa submodule pointer (fail-closed claims
 enhancer + end-entity cert constraints)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 5b63fdd64..ed178ddc8 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 5b63fdd64a91c38f45578a13b061077d0cd389ba
+Subproject commit ed178ddc8029b7d5e152bd8cb93887cde1bc94f3

From 87368a1ba7b1a3b5b48799b329e0c26c68c66411 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 15:53:50 +0200
Subject: [PATCH 21/35] chore: update uaa submodule pointer (secretless mTLS
 clients + claim-mappings validation)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index ed178ddc8..6f99d7036 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit ed178ddc8029b7d5e152bd8cb93887cde1bc94f3
+Subproject commit 6f99d7036146995125e7b32ddf578ab5cec49a6a

From 9603c6b84ec50454eec58eb1dc7a0365a88f959f Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 21 Aug 2026 17:10:57 +0200
Subject: [PATCH 22/35] chore: update uaa submodule pointer (ReDoS length-bound
 fix + cnf fail-closed fix)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 6f99d7036..c4d8aee44 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 6f99d7036146995125e7b32ddf578ab5cec49a6a
+Subproject commit c4d8aee44e95d5d4796469855d524ce32bd08bdf

From 06315bc86533abcc719bd26aaa5dc33619e2d646 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 24 Aug 2026 10:15:13 +0200
Subject: [PATCH 23/35] chore: update uaa submodule pointer (proxy leaf
 constraints + FIPS provider verification + mtls-enabled docs)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index c4d8aee44..0e78d80fe 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit c4d8aee44e95d5d4796469855d524ce32bd08bdf
+Subproject commit 0e78d80fe5e850cdf8a6ecfcc6023554b3fb9747

From 736766b19023745143c74e6719ce0db6c5e7bbac Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 24 Aug 2026 15:32:27 +0200
Subject: [PATCH 24/35] chore: update uaa submodule pointer (mtls discovery
 gating + BCFIPS verification + REST docs coverage)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 0e78d80fe..2390647cd 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 0e78d80fe5e850cdf8a6ecfcc6023554b3fb9747
+Subproject commit 2390647cd2aa2d4c4e6cba588a9c6e6e33afee45

From 5dec183abe967d393d4707ddcaae87dab9be7903 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 24 Aug 2026 16:26:27 +0200
Subject: [PATCH 25/35] chore: update uaa submodule pointer (fix CI regression
 in discovery-document tests)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 2390647cd..c1bbd85fa 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 2390647cd2aa2d4c4e6cba588a9c6e6e33afee45
+Subproject commit c1bbd85fa38c0dab39a588390296eeab1ff0185c

From 4682418a0887a7d17f6981e9b6fbe2e28d0affb0 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 26 Aug 2026 11:55:57 +0200
Subject: [PATCH 26/35] fix(review): remove unimplemented configurable mTLS
 endpoint path

---
 jobs/uaa/spec                         |  6 +-----
 jobs/uaa/templates/config/uaa.yml.erb | 13 ++++++++-----
 spec/uaa-release.erb_spec.rb          | 13 +++++++++++++
 src/uaa                               |  2 +-
 4 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/jobs/uaa/spec b/jobs/uaa/spec
index 08fdfc69d..e9de2ae66 100644
--- a/jobs/uaa/spec
+++ b/jobs/uaa/spec
@@ -1308,12 +1308,8 @@ properties:
             -----END CERTIFICATE----
 
   uaa.mtls_enabled:
-    description: "Enable the RFC 8705 mTLS token endpoint at uaa.mtls_endpoint_path. Requires Gorouter forwarded_client_cert: sanitize_set."
+    description: "Enable RFC 8705 mTLS client authentication at /oauth/mtls/token. Requires Gorouter forwarded_client_cert: sanitize_set."
     default: false
-
-  uaa.mtls_endpoint_path:
-    description: "Path for the mTLS token endpoint"
-    default: "/oauth/mtls/token"
   login.saml.providers:
     description: |
       Contains a hash of SAML Identity Providers,
diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index 107ce7ac8..a4ba54c57 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -369,6 +369,10 @@
       client.each do |key,value|
         client_data[key] = value
       end
+      has_mtls_ca = client_data['tls-client-auth-ca'].is_a?(String) &&
+          !client_data['tls-client-auth-ca'].strip.empty?
+      message = message + "\nInvalid property: uaa.clients.#{id}.token-endpoint-auth-method" unless
+          client_data['token-endpoint-auth-method'].nil?
       if !client['scopes'].nil?
         client_data.delete('scopes')
         if client['scopes'].is_a? Array
@@ -380,7 +384,10 @@
       if is_missing(client_data, 'authorized-grant-types')
         message = message + "\nMissing property: uaa.clients.#{id}.authorized-grant-types"
       else
-        message = message + "\nMissing property: uaa.clients.#{id}.secret" if client_data['secret'].nil? && client_data['authorized-grant-types'] != 'implicit' && client_data['token-endpoint-auth-method'] != 'tls_client_auth' && client_data['token-endpoint-auth-method'] != 'private_key_jwt'
+        message = message + "\nMissing property: uaa.clients.#{id}.secret" if
+            client_data['secret'].nil? &&
+            client_data['authorized-grant-types'] != 'implicit' &&
+            !has_mtls_ca
         if (client_data['redirect-uri'].nil? || client_data['redirect-uri'].empty?)
           message = message + "\nMissing property: uaa.clients.#{id}.redirect-uri" if client_data['authorized-grant-types'] =~ /implicit|authorization_code/
         elsif client_data['redirect-uri'].split(',').any? { |uri| !(uri =~ /^http(\*|s)?:\/\/(.*:.*@)?(([a-zA-Z0-9\-\*]+\.)*[a-zA-Z0-9\-]+\.)?[a-zA-Z0-9\-]+(:[0-9]+)?(\/.*|$)/) }
@@ -880,7 +887,3 @@
 
 %>
 <%= render(params) %>
-<% if p("uaa.mtls_enabled") %>
-mtls:
-  endpoint: <%= p("uaa.mtls_endpoint_path") %>
-<% end %>
diff --git a/spec/uaa-release.erb_spec.rb b/spec/uaa-release.erb_spec.rb
index d04fe1547..7c6923fc5 100755
--- a/spec/uaa-release.erb_spec.rb
+++ b/spec/uaa-release.erb_spec.rb
@@ -183,6 +183,19 @@ def str_compare(output, actual)
       end
     end
 
+    context 'when mTLS is enabled' do
+      let(:input) {'spec/input/test-defaults.yml'}
+      let(:erb_template) {'../jobs/uaa/templates/config/uaa.yml.erb'}
+
+      before do
+        generated_cf_manifest['properties']['uaa']['mtls_enabled'] = true
+      end
+
+      it 'does not render a configurable mtls endpoint block' do
+        expect(parsed_yaml).not_to have_key('mtls')
+      end
+    end
+
     context 'for deprecated-properties-still-work.yml' do
       let(:input) {'spec/input/deprecated-properties-still-work.yml'}
       let(:output_uaa) {'spec/compare/deprecated-properties-still-work-uaa.yml'}
diff --git a/src/uaa b/src/uaa
index c1bbd85fa..b13db7ccf 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit c1bbd85fa38c0dab39a588390296eeab1ff0185c
+Subproject commit b13db7ccfe6febb1e8abafa4a67ac6597c8d62d6

From cb46887655d8a000dab792249acea9ab43aaf7ef Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 26 Aug 2026 12:42:32 +0200
Subject: [PATCH 27/35] fix(review): validate CA-based secretless BOSH clients

---
 jobs/uaa/templates/config/uaa.yml.erb |  4 +--
 spec/uaa-release.erb_spec.rb          | 38 +++++++++++++++++++++++++++
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index a4ba54c57..59b800e45 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -371,8 +371,8 @@
       end
       has_mtls_ca = client_data['tls-client-auth-ca'].is_a?(String) &&
           !client_data['tls-client-auth-ca'].strip.empty?
-      message = message + "\nInvalid property: uaa.clients.#{id}.token-endpoint-auth-method" unless
-          client_data['token-endpoint-auth-method'].nil?
+      message = message + "\nInvalid property: uaa.clients.#{id}.token-endpoint-auth-method" if
+          client_data.key?('token-endpoint-auth-method')
       if !client['scopes'].nil?
         client_data.delete('scopes')
         if client['scopes'].is_a? Array
diff --git a/spec/uaa-release.erb_spec.rb b/spec/uaa-release.erb_spec.rb
index 7c6923fc5..bc0930644 100755
--- a/spec/uaa-release.erb_spec.rb
+++ b/spec/uaa-release.erb_spec.rb
@@ -1274,6 +1274,44 @@ def str_compare(output, actual)
         end
       end
 
+      context 'client_credentials mTLS clients' do
+        let(:erb_template) {'../jobs/uaa/templates/config/uaa.yml.erb'}
+
+        before do
+          client = generated_cf_manifest['properties']['uaa']['clients']['app']
+          client['authorized-grant-types'] = 'client_credentials'
+          client.delete('secret')
+        end
+
+        it 'allows a secretless client with a nonblank tls-client-auth-ca' do
+          generated_cf_manifest['properties']['uaa']['clients']['app']['tls-client-auth-ca'] = "-----BEGIN CERTIFICATE-----\nCA\n-----END CERTIFICATE-----"
+
+          expect { parsed_yaml }.not_to raise_error
+        end
+
+        it 'requires a secret when tls-client-auth-ca is absent' do
+          expect {
+            parsed_yaml
+          }.to raise_error(ArgumentError, /Missing property: uaa.clients.app.secret/)
+        end
+
+        it 'requires a secret when tls-client-auth-ca is blank' do
+          generated_cf_manifest['properties']['uaa']['clients']['app']['tls-client-auth-ca'] = ' '
+
+          expect {
+            parsed_yaml
+          }.to raise_error(ArgumentError, /Missing property: uaa.clients.app.secret/)
+        end
+
+        it 'does not exempt a client with private-key trust configuration from requiring a secret' do
+          generated_cf_manifest['properties']['uaa']['clients']['app']['client_jwt_config'] = '{}'
+
+          expect {
+            parsed_yaml
+          }.to raise_error(ArgumentError, /Missing property: uaa.clients.app.secret/)
+        end
+      end
+
       context 'redirect-uri is missing from required grant types' do
         let(:erb_template) {'../jobs/uaa/templates/config/uaa.yml.erb'}
         grant_types_requiring_secret = ['authorization_code', 'implicit']

From 9623bdb2358a7a7f25796d633932a8959d39a8a9 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 26 Aug 2026 12:47:29 +0200
Subject: [PATCH 28/35] chore: update uaa submodule pointer (secretless mTLS
 docs client)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index b13db7ccf..8ebd5ebbc 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit b13db7ccfe6febb1e8abafa4a67ac6597c8d62d6
+Subproject commit 8ebd5ebbc1e4e0532a4311a1b20b1de22078f247

From 973a147ee99ed8d605b592b597939c8162ce3901 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Wed, 26 Aug 2026 13:40:57 +0200
Subject: [PATCH 29/35] chore: update uaa submodule pointer

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 8ebd5ebbc..be41a4ebf 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 8ebd5ebbc1e4e0532a4311a1b20b1de22078f247
+Subproject commit be41a4ebfea093b489113244dcd1728c2c22af5d

From 45781c9d270c17552776394784d6da7e0c54d474 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Thu, 27 Aug 2026 15:22:09 +0200
Subject: [PATCH 30/35] chore: update uaa submodule pointer (mTLS selector and
 discovery consistency)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index be41a4ebf..d479e856b 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit be41a4ebfea093b489113244dcd1728c2c22af5d
+Subproject commit d479e856b6fc9807ea3b360a599a95a631f26861

From 0dc8a51105a8470b8e30f1b3cdbbdc68209be1c6 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 28 Aug 2026 13:13:25 +0200
Subject: [PATCH 31/35] chore: update uaa submodule pointer (zone mTLS CA
 normalization)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index d479e856b..eaafe83c0 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit d479e856b6fc9807ea3b360a599a95a631f26861
+Subproject commit eaafe83c0f1478b94a0e5f01076e5706839752a9

From 4f44fb62d6cb38a615277862d683645cd3411e53 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Fri, 28 Aug 2026 14:36:47 +0200
Subject: [PATCH 32/35] chore: update uaa submodule pointer (merge develop)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index eaafe83c0..b912c12b2 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit eaafe83c0f1478b94a0e5f01076e5706839752a9
+Subproject commit b912c12b25c01ba0b9b9c83106c1238ab89ba97c

From db51c294bc05ebd717351887a9be9f39a0e83604 Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 31 Aug 2026 13:18:42 +0200
Subject: [PATCH 33/35] chore: update uaa submodule pointer (mTLS JWT docs and
 RDN claims)

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index b912c12b2..86174f39a 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit b912c12b25c01ba0b9b9c83106c1238ab89ba97c
+Subproject commit 86174f39aeafff8a65dad4a0f751b0f892d8812f

From a84c915884f7167d4ae9b8a4c7201c63d5ebcf5d Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Mon, 31 Aug 2026 15:03:56 +0200
Subject: [PATCH 34/35] fix(review): omit blank trusted proxy CA

---
 jobs/uaa/templates/config/uaa.yml.erb | 3 +++
 spec/uaa-release.erb_spec.rb          | 6 ++++++
 src/uaa                               | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/jobs/uaa/templates/config/uaa.yml.erb b/jobs/uaa/templates/config/uaa.yml.erb
index 59b800e45..958d776b8 100644
--- a/jobs/uaa/templates/config/uaa.yml.erb
+++ b/jobs/uaa/templates/config/uaa.yml.erb
@@ -371,6 +371,9 @@
       end
       has_mtls_ca = client_data['tls-client-auth-ca'].is_a?(String) &&
           !client_data['tls-client-auth-ca'].strip.empty?
+      client_data.delete('tls-client-auth-trusted-proxy-ca') if
+          client_data['tls-client-auth-trusted-proxy-ca'].is_a?(String) &&
+          client_data['tls-client-auth-trusted-proxy-ca'].strip.empty?
       message = message + "\nInvalid property: uaa.clients.#{id}.token-endpoint-auth-method" if
           client_data.key?('token-endpoint-auth-method')
       if !client['scopes'].nil?
diff --git a/spec/uaa-release.erb_spec.rb b/spec/uaa-release.erb_spec.rb
index bc0930644..270eb9c32 100755
--- a/spec/uaa-release.erb_spec.rb
+++ b/spec/uaa-release.erb_spec.rb
@@ -1289,6 +1289,12 @@ def str_compare(output, actual)
           expect { parsed_yaml }.not_to raise_error
         end
 
+        it 'omits a blank tls-client-auth-trusted-proxy-ca' do
+          generated_cf_manifest['properties']['uaa']['clients']['app']['tls-client-auth-trusted-proxy-ca'] = ' '
+
+          expect(parsed_yaml['oauth']['clients']['app']).not_to have_key('tls-client-auth-trusted-proxy-ca')
+        end
+
         it 'requires a secret when tls-client-auth-ca is absent' do
           expect {
             parsed_yaml
diff --git a/src/uaa b/src/uaa
index 86174f39a..1e83ee707 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 86174f39aeafff8a65dad4a0f751b0f892d8812f
+Subproject commit 1e83ee707954d3865eab4eb41d5e95868c3a4253

From 4f0248359370d474d746c4d75a07770f1283e7bf Mon Sep 17 00:00:00 2001
From: rkoster <hi@rkoster.dev>
Date: Thu, 3 Sep 2026 13:26:14 +0200
Subject: [PATCH 35/35] chore: update uaa submodule pointer

---
 src/uaa | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/uaa b/src/uaa
index 1e83ee707..aeb439805 160000
--- a/src/uaa
+++ b/src/uaa
@@ -1 +1 @@
-Subproject commit 1e83ee707954d3865eab4eb41d5e95868c3a4253
+Subproject commit aeb43980599ea9c4b4f1104d59e3661c53a2caff