Certificate binding is the act of linking an identity claim to the exact certificate that was actually authenticated. In practice, a server does not just check that a certificate is valid; it also verifies that the certificate belongs to the specific user, device, service, or application being claimed.
This matters because many attacks exploit trust mismatches. If a system accepts a name, token, or application identity without binding it to the presented certificate, an attacker may impersonate a trusted peer and bypass authentication. Strong certificate binding is common in mutual TLS, management-plane access, and certificate-based service trust. Defenders enforce it by comparing certificate identity fields, fingerprints, or trust anchors against the expected peer, rejecting mismatches, and logging failed validation. When certificate binding is weak, a login shortcut can become an administrative gate.