[Dance] [saag] Best practices for applications using X.509 client certificates (fwd) David Woodhouse: [saag] Best practices for applications using X.509 client certificates

I raised $SUBJECT on this list in 2016, lamenting that all applications
which can use a certificate for SSL client authentication seem to hate
their users:
https://mailarchive.ietf.org/arch/msg/saag/4F82uK-CJdXmS42cC4-bn62pojU/

In response to that discussion, I created this draft to describe what I
consider "best practice" for a client application:
http://david.woodhou.se/draft-woodhouse-cert-best-practice.html

The gist of it is, "this stuff should Just Work". Whatever form I get
my cert+key in from the baroque outdated corporate infrastructure that
issues them — as long as it's not *completely* unreasonably insane — I
should just be able to give that to *any* application and expect it to
work.

That goes for files containing PKCS#1, PKCS#8, PKCS#12 or even TPM-
wrapped keys. And in place of a filename I should be able to pass a
reference like a RFC7512 PKCS#11 URI (or similar URIs for system key
stores or TPM internal storage) and *that* should just work too.

We've had a little bit of success over the years in making life better
for users. It's now more common for applications to automatically
accept a PKCS#11 URI in place of a filename, for example, and we've
defined a standard file format for TPMv2.0 key storage which is
interoperable between the two OpenSSL provider/engines and GnuTLS
implementations.

I've just updated the above draft to reference the TPMv2 support, and
I'd like work out what it would take to submit it as an actual I-D. As
noted by Ted Lemon last time, the challenge would be socializing it to
the people who need to read it. Publishing it through the IETF as an
informational RFC would certainly be better than sticking it on my own
web page in draft form.

There's plenty of technical heckling to be done on the content, for
sure, but also a process question there.

Any input would be much appreciated; thanks!

[Dance] [saag] Best practices for applications using X.509 client certificates (fwd) David Woodhouse: [saag] Best practices for applications using X.509 client certificates

Attachment: smime.p7s