apr_byte_t oidc_util_json_validate_cnf_x5t_s256(request_rec *r,
		int token_binding_policy, const char *x5t_256_str) {
	const char *fingerprint = NULL;

	fingerprint = oidc_util_get_client_cert_fingerprint(r);
	if (fingerprint == NULL) {
		oidc_debug(r, "no certificate (fingerprint) provided");
		goto out_err;
	}

	if (apr_strnatcmp(fingerprint, x5t_256_str) != 0) {
		oidc_warn(r,
				"fingerprint of provided cert (%s) does not match cnf[\"x5t#S256\"] (%s)",
				fingerprint, x5t_256_str);
		goto out_err;
	}

	oidc_debug(r, "fingerprint of provided cert (%s) matches cnf[\"x5t#S256\"]",
			fingerprint);

	return TRUE;

	out_err:

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_OPTIONAL)
		return TRUE;
	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_ENFORCED)
		return FALSE;

	// token_binding_policy == OIDC_TOKEN_BINDING_POLICY_REQURIED
	return (fingerprint == NULL);
}
apr_byte_t oidc_util_json_validate_cnf_x5t_s256(request_rec *r,
		int token_binding_policy, const char *x5t_256_str) {
	const char *fingerprint = NULL;

	fingerprint = oidc_util_get_client_cert_fingerprint(r);
	if (fingerprint == NULL) {
		oidc_debug(r, "no certificate (fingerprint) provided");
		goto out_err;
	}

	if (apr_strnatcmp(fingerprint, x5t_256_str) != 0) {
		oidc_warn(r,
				"fingerprint of provided cert (%s) does not match cnf[\"x5t#S256\"] (%s)",
				fingerprint, x5t_256_str);
		goto out_err;
	}

	oidc_debug(r, "fingerprint of provided cert (%s) matches cnf[\"x5t#S256\"]",
			fingerprint);

	return TRUE;

	out_err:

	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_OPTIONAL)
		return TRUE;
	if (token_binding_policy == OIDC_TOKEN_BINDING_POLICY_ENFORCED)
		return FALSE;

	 
	return (fingerprint == NULL);
}