IETF Logo Mail Archive

[lamps] Re: [TLS] Re: Re: [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey

Mike Shaver <mike.shaver@gmail.com> Wed, 01 April 2026 23:37 UTC

Return-Path: <mike.shaver@gmail.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9D95FD532AC4 for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 16:37:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775086622; bh=O/hV9BecHmQTIdmN9hrK8j9emqQxzXZd7ji4BnvinHI=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=rWEX7HfZsPezvrKDSrZNii9OJk0we9pVsjZrLF/MH4yb5SPtJWUWJS5p/HGkd3hqp 1GuCxkvhW8bU2wFDJh8tO4tjow5rPLhQsjhwZnYm6oySmZE/71WPxfK2/BgajZlg4C RqgG/COf+Pjea7bJCljyGq/vLWtVncI1KdX3EKHw=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KLLUJ9VqmMha for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 16:37:02 -0700 (PDT)
Received: from mail-oi1-x236.google.com (mail-oi1-x236.google.com [IPv6:2607:f8b0:4864:20::236]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 4ECC2D532AAE for <spasm@ietf.org>; Wed, 1 Apr 2026 16:37:02 -0700 (PDT)
Received: by mail-oi1-x236.google.com with SMTP id 5614622812f47-46704177508so203911b6e.0 for <spasm@ietf.org>; Wed, 01 Apr 2026 16:37:02 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1775086615; cv=none; d=google.com; s=arc-20240605; b=ZoKnEn3+kjp8tH7STOSh7Jgsyj1O+26/wcfBx0Yt1H9+Cl9R3zGcTtBsvapwUeZMjC 3x6xVrl3UZbMtfzegb/urc5YaKwnYSDcsAt1V4WzTkUgPtUds0pxjGYzNwQ2Gbp2ZUt0 KKYfEhvzzlZ1/R1uqMuzUsRaumyFsmZtFdPYBQaKZzh4HE+mXCjFkV9oRQNnvb8GaSih saQcy4xFx/GeZQgd7e1AjCFbmjliC0aVYBkOo1qYBi1hQ07d1wLctkMfEjyh2p+JuD05 pBU5xpGLxWawPyHubiza/xVgY5ZLslDb3tiIaUSHKJYmfH55CIfeGkULgbOsafscwwGR VNLQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=JyTWgolmY05Hg20MBG+9TvyIMk2JViXvs4WbZ49T5ws=; fh=JNSmxfCyv6oxNxSaYWZz383UWK6dbYLPCZfzmjG9reg=; b=ftS44XqPe4auN5TGX+FHlQYGkdifpDr4NVxyb02F/mie8/lGK779H7ceIiwapoay4L aYWp1Pqfu55MBKnwe8PlUjzgMrdxJg2B/KSMrZ29dY90/DcmF7oPoFpsTzK+Zm8las5P PBsIQfHnCsDeStjb1k6tK372C6sfe/syk0EVQK9QUOg/qcpOtZd2D8i5i2Qy+F0ixj6H ydkh0qDOC+8DdAU/y/E/CyQ4YF78+hps8RJssK2fQb1Xnj0Mx+6XeY0NzC+LeZtzlf+H TmSWctDx3ouJoicvW6QP5HhHQZLxJRr++sD5LsLgEL97uqxTi191iC7b4a1jSWeyscIF +Rlg==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775086615; x=1775691415; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=JyTWgolmY05Hg20MBG+9TvyIMk2JViXvs4WbZ49T5ws=; b=l0Vr7rd0d8XoDtz77/vXhM64m9VweoTmQOUNVWOCBNJD5/q2iLLVbjSnL+wdH5bd6B bDRTJr49pNjN4oPakJ2E66p3R5RQv+Ta/vZml+DUNRy9xenjUy2XH+fJESgl5cCzpyoc nj4avBe0E6sNaCESShW3sJXWi0lovip0FzkIBY/DI0gw6djw1YsQz6AsaVntEFyq8QII o/nJzXLTOqU0bmLYxQNrcDbba6lRw+0svcS3UCA/x+bqLDpWSi6lZZqJkd7C1toqCF0D V0J3C+7/U5Q2zA+vW6jymZtI/+ASFjeoWC3ewnKtOcTshBa2ku45qUruQOHRjRgPglLb 6MvQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775086615; x=1775691415; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=JyTWgolmY05Hg20MBG+9TvyIMk2JViXvs4WbZ49T5ws=; b=B8Qhs7YfFgZlIXug6+K9jt7ooHLF8Jhwo6PhEn1r+caVZ0crtQaZLQWWq+39WzK9ik BFGRD9j4YgkFT6n80VCPC3TLIY1nAhOnCnJZk3M8cl01OYjKozG82Gm/7NpqdFJZ7Vcg ALr0K0aEV/7Aixsg/eb32CyPP6V+NuEZ45Jw4UtsnpKZS5ICUijtrAhn1TpiaaS66aj1 99Ke8+u3rAQp8+S+RsK7ZZNkOsQ34m50yckP8pjVSztj1jyn4eh4L3jW1bxSj7Upm52j eJw3bod0c37Zwm/7X+Jv9KcDwopYOzCNpTV3JPl6/CsAKLg0O2A1xJrZUKn1Vn36VL8y IGdw==
X-Forwarded-Encrypted: i=1; AJvYcCXvj0wiEk1m9tGBF9VkuQZjptsVnpavaHKhrBXOCj1RNQzYBiqh2M9ILdQKcognlULpmabT6A==@ietf.org
X-Gm-Message-State: AOJu0Yxcju6he5FQuqhTutEg6pwhhhti22Io+X0dSXgEjF8/8n4VNoWW RT6uhtTiE+8a3TLIuW9G8FnaJG/AuiwnaSPk0ArmGAA7RSS2hWem9jb405bvOj2hiMzXZqR7inU D1inmUWQOYzKEPEmkmcpgR+xQV02uLT4=
X-Gm-Gg: ATEYQzwMzudKVAIJLHexOWrSi/AALbb/jVggesUGBkED3d2i9H8hJC3pU9c7bSqKYpY OOQzqEnULY2NwyTU1/6v3Gz0Zbw3S22bkt9Tm6YuLWWTqi0Zj3MnKhDy6iCzx4GAsx9nK7wJJon u/wc0HxYyYQ6b0ef64D3w6KGa9s9S+CKktXLzEEiR6QHb6jFifFfDJUrc1wcub+c5fg1RAq/5w1 rcrc2jadcrsQBN4ps9oEj0TO1vzimS8ckOmlg1hUq52DU6AfK+k86cI4KrUs7oZoR+N/J7aof39 89xsNrQ=
X-Received: by 2002:a05:6808:1792:b0:467:27d2:96a7 with SMTP id 5614622812f47-46adffe5556mr3130620b6e.15.1775086615012; Wed, 01 Apr 2026 16:36:55 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <ac15yB5aylmUnjc6@ubby> <LV0PR21MB66238385ED1FFD508AE4B02F8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <ac2hvBKZUgEE78nS@ubby>
In-Reply-To: <ac2hvBKZUgEE78nS@ubby>
From: Mike Shaver <mike.shaver@gmail.com>
Date: Wed, 01 Apr 2026 19:36:44 -0400
X-Gm-Features: AQROBzAfjD66f8XlPviuHNFa77AgVzB6-arxEirCtc0fZrMPLGZGY1azEBDod6c
Message-ID: <CADQzZqtoQk14dbcBqRZF5BT0jVQfJjaOzXDFrxeSj3coVcpXVw@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
Content-Type: multipart/alternative; boundary="0000000000002228d6064e6e8f76"
Message-ID-Hash: 33PNTHTWLRBPESHC6QJXNIU6GBCLTDF6
X-Message-ID-Hash: 33PNTHTWLRBPESHC6QJXNIU6GBCLTDF6
X-MailFrom: mike.shaver@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Andrei Popov <Andrei.Popov@microsoft.com>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] Re: Re: [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/41lQ3NxNkpLa0IUr2m70XEJM-vA>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Wed, Apr 1, 2026 at 6:53 PM Nico Williams <nico@cryptonector.com> wrote:

> Though someone just wrote me off-list that:
>
> | I know at least of GlobalSign Client Authentication Root R45 and
> | GlobalSign Client Authentication Root E45 (but have no experience with
> | them).
> |
> |
> https://support.globalsign.com/ca-certificates/root-certificates/globalsign-root-certificates
>
> So perhaps not all CAs have exited that market.  But this is just their
> root certificates; I've not yet found how to get a client certificate
> from them nor how much it costs.


That seems like research that might inform your future position on these
matters. Multiple CAs are offering client auth certs under separate roots,
and servers are welcome to trust the roots in question if they wish to
participate in that particular PKI.

Mike

v2.46.0 | Report a Bug | By Email | System Status