IETF Logo Mail Archive

[lamps] Re: [TLS] TLS Client Certificates; a survey

Raghu Saxena <poiasd@saxrag.com> Tue, 24 March 2026 05:18 UTC

Return-Path: <poiasd@saxrag.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 4E36ED074996; Mon, 23 Mar 2026 22:18:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=saxrag.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OuYAa79GkpeO; Mon, 23 Mar 2026 22:18:56 -0700 (PDT)
Received: from mail.saxrag.com (mail.saxrag.com [51.75.207.79]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B6378D07497E; Mon, 23 Mar 2026 22:18:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=saxrag.com; s=default; t=1774329529; bh=49vnrePA/sdlV3dBRVNn4VsUB0hzIQ8DKXeL8ZqxQd0=; h=Date:To:References:From:Subject:In-Reply-To:From; b=TcQU4gZw+wPjbCsn7H3kFsLGIaTXsGAy9twaCrtY5LRKVt8atR7GQIk+OBItNzqLc S0EK4OKoQXoO8Ilze7LAuD0rIDQwBPf6oJxaSfBA/n+cLYZRt3fQ9eoGK+HCVRqWJ8 vdkQLxTMzIb6UTi7tX/9a40hsmjgGCqm6OqgIeWzGDrRdekiP08tvWjBwCiHXpoFrX ek4AxE6YtUWXNEAeeXyvBz2ckgZdMPRAtwrNUVSbAoB5kRZyfKbqInJYVLkrGiHHnU adktMz0k2DwCkrM4RQ8+AJs3gsu3Igy/O6qhzNO3MYn0A6g6JDSq2SrezrvpCM33ks WqWU8PPe2Wtqg==
Message-ID: <b4f72332-6987-46f0-9021-afa414f7b571@saxrag.com>
Date: Tue, 24 Mar 2026 13:18:32 +0800
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
Content-Language: en-US
From: Raghu Saxena <poiasd@saxrag.com>
In-Reply-To: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------PCbMZSlnBO2UiM645CIXlmSm"
Message-ID-Hash: 4AI6Y3BGMGWLMDG5CTZ3ZBP4TLMUBS4I
X-Message-ID-Hash: 4AI6Y3BGMGWLMDG5CTZ3ZBP4TLMUBS4I
X-MailFrom: poiasd@saxrag.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/4BPIwnWqhI8MPBs64owIC4ESi5o>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

I need to use mTLS for client auth with Financial Institutions. They've 
now switched to X9 PKI[0], needed to add the X9 PKI root to my 
application's trust store, otherwise not too bad. The traditional CA 
client certs I'm using are still valid for clientAuth, but probably 
would need to switch to X9 PKI once they expire.

Sidenote: Google's influence is kinda crazy in this regard; they just 
said Chrome would not accept these anymore, and all the CAs immediately 
dropped clientAuth. Scary.

Regards,
Raghu Saxena

[0] https://www.digicert.com/campaigns/asc-x9

On 3/23/26 10:33 PM, Salz, Rich wrote:
> Since WebPKI CA’s will not be able to issue TLS-Client certificates, 
> what are the customers and CAs thinking of doing?
>
> Replies to be will be summarized to both lists. Please be careful if 
> you use reply-all.
>
>
> _______________________________________________
> TLS mailing list -- tls@ietf.org
> To unsubscribe send an email to tls-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status