IETF Logo Mail Archive

[lamps] Re: [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey

Andrei Popov <Andrei.Popov@microsoft.com> Wed, 01 April 2026 18:53 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 32ACCD4FCD9F; Wed, 1 Apr 2026 11:53:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775069587; bh=3AhZFg8mLx+mXbbkSxHhipm+tqEFm7LHyNlbj+EEa8Q=; h=From:To:CC:Subject:Date:References:In-Reply-To; b=jpOztq3KyrTsYsV+frd1i9v90eH08EB+otWqQPmOaJHwOu9KJmfx55xw8sxyv+PsO 1XBfdWS8g/sgpweikXyphqHCp3kYqlsgcFYG6LvQHZZazf8TsiZyVUCmG7/zFJX9Ha tPQqwGYTPR0SvHdZpnnJLxqAvgd9CnaRh+PhNiF4=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H5l4mthbSwNB; Wed, 1 Apr 2026 11:53:06 -0700 (PDT)
Received: from CH1PR05CU001.outbound.protection.outlook.com (mail-northcentralusazon11020143.outbound.protection.outlook.com [52.101.193.143]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C3426D4FCD97; Wed, 1 Apr 2026 11:53:06 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hwD91AsSmNYt36x6qZN76yaUh5qgr6EXxDMLRGHgQgsDYAutUO7IS+db7xckMj3jMx8VusSPdJApoi2WhDAJxG/k7y4A+tIf0gVGPcT6K7hoLoHeKaaTEkNcwEUY8sEKrervPJ7lqnqYEWC83NiZmbwQ0jFqaJqDW2UeiKlzgBQh91TBQUF2x3vaLldRuNCB2RkT5ZFleLwm8WTBXNAI7ho2dq3YWvhZVN1BW/qNTFW7DUGp6WdvMQBBaxHNrXAhcHAOjw653KwCu3kL5sNObGxFUn7dj4HteYF6GIbKZKBHeC8Dpl7f77Q/uZc11Lw7qMapkUIPp+9ZpFfwZ3xl5w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3AhZFg8mLx+mXbbkSxHhipm+tqEFm7LHyNlbj+EEa8Q=; b=fUQdmcAgmCTTUiI/YRsOrCK5Sj/T0+18p//2E5o2WC0L3sFXLp1GzJS3svXSeIFnrwE14jXvGvx/h/tkmdKR5LPU2vrHXAPbmpdSfqt76PCdqry5Qmm7gzBKSCkJ3B4lfIjggJ6kBW25DqNJJIQP0PPZGapz7nu4nKujMrCCONh4czvasNEv9wRITZQ4e+MQDl6Z7ajSqV1wuB2Zwv2TY21haBWWOXMjev4M5gPoTmGjMClv3koJS4pIES+orrpNw2VOVL/fq9daQl9NwidMlhfWRkyYpoP5tK8+GICqeUbEZu0SyEfrPwkKzMS8oXSEA+UD+O645lWz73seArlqNQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3AhZFg8mLx+mXbbkSxHhipm+tqEFm7LHyNlbj+EEa8Q=; b=X+9bwFNc2rW9NgLwRAHAHmFmuNjJD4XLH3RCtNr81crEmoOhVTwI9MOswnbxQy6S4/AuUu0CAZQwtm96CS5UZURRTmDuh2ySRRZzFAWvngPoqlgO0syIEt6EEJqfYyD6jkcx3dMpJzVP45lSXGPAlRMc90eBraYZJxNsmaZt+CU=
Received: from LV0PR21MB6623.namprd21.prod.outlook.com (2603:10b6:408:332::23) by LV9PR21MB5359.namprd21.prod.outlook.com (2603:10b6:408:2bc::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.15; Wed, 1 Apr 2026 18:52:58 +0000
Received: from LV0PR21MB6623.namprd21.prod.outlook.com ([fe80::f1c5:29c7:254:49c6]) by LV0PR21MB6623.namprd21.prod.outlook.com ([fe80::f1c5:29c7:254:49c6%4]) with mapi id 15.20.9769.014; Wed, 1 Apr 2026 18:52:58 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Peter Gutmann <pgut001=40cs.auckland.ac.nz@dmarc.ietf.org>, David Adrian <davadria@umich.edu>, Mike Ounsworth <ounsworth+ietf@gmail.com>
Thread-Topic: [EXTERNAL] [TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey
Thread-Index: AQHcwb6+sQRNBWzmjUWQpRgfxNTgELXKjMTA
Date: Wed, 01 Apr 2026 18:52:58 +0000
Message-ID: <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com>
In-Reply-To: <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=bf3df1ed-122b-4cf7-8b84-64fb42a10078;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2026-04-01T18:48:28Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Tag=10, 3, 0, 1;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=microsoft.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LV0PR21MB6623:EE_|LV9PR21MB5359:EE_
x-ms-office365-filtering-correlation-id: bed76295-55bd-4497-e00b-08de901fe4a2
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|4022899009|366016|376014|38070700021|22082099003|18002099003|56012099003;
x-microsoft-antispam-message-info: WoBW73pQCfdVHlFapOoh8pEM2ue+B7Lm705aPddw1yZwY7Bnoqtm5WAO3bZ+jJ1JcBTkaCSZ2zj2QXDCpyHVbNxCyKD6aBUlP0SOrb7pR9fo4bElp+AhrMDOoTHCvWhCu6s4AtFZuhCd/9Ams4e50PaDr1rPmDFmgNC6zu2cMoUMCwGZbV39GgD/Lr4e8t7gVL6S/GrZahPHCAplXz0qo5oCnYV0JGGNqgAFxJFtlK1qQKS3x0U/QGxRyj9KmpXwZgH/McFzPGKzWp97JeiSvpAhT36U7wdpduyLYNmNTC3f074qn8VqztHiHm9Wk6KjGl+i1heEowIP2RJH2D5XMXDy4jniZmp+NdwiAOGJRYdOeeAvuM7oP7W2Pa33H6oJlV4STNLU6Jcy9KuDlJUmX/c7rOcm41DKM8hW+jdDVnZusZ2dbwxOIHGl1Geya66MRHlkW+pqj9Il6XlI7alpJ4wjNQxwzUGuPhzrwtLlmthKan3tCmGBXzLUj93eEUx3261oZWZT3lSDtZBOb9tcoX2EjG4v1N9pxS7DXF9Cr6UfKbsxCh70vWpWpBEsf0hXth3hAwRZ0WhkqtT/xNixfHuYQ0PlIHP8oZWg4yHsAsJXZZuza0BTQ4eDCe4dJKueBYi1qPrH/VpqLef9MtcjwjDdad0TS2PWZ/hjeo3muke4hYIXt2ZXMJVPKzR3dBU1we9HH2bvjdJQq1MySOpDsRaIPxbDY2y4AssrqaRpXAySXdRH9eDIRCrhNGSzt2Gpn4tDvRFe11Da71NLpr4DiS+M++ce+V0MHSSV9BhCHyc=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV0PR21MB6623.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(4022899009)(366016)(376014)(38070700021)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 6FTYFUHJjqcS2qRPLO1TwEgZQD0Ee8L5yg3M2QRLXMQygC+R5WH5uw0z3BXZP1WgeMmSVZUYQgyyoGIzY2DtpagXFTjpMMYXdM0VIq4rrdDojcE+wnhzxsF5CCtwqHmNld3vSbrTwCyT64dAl62E6xQRADVzW7ThAZzInVn9ENsXkL5WqMKuZ1UsIsdNCNgRAvuKn2CVk8Mj8PKexZOiGm9KLi22ysxYyaFP6o3/gTPPLHgQjMImCmuhSqgYL7dER107KfnfjXqb+TRtCqbpfxS3iXpBcGvhFBjW8ottTtMR3JUU4MONdJrJj8bua7BCGUe5XYxIInvoZWHPfXNFtB/kfoq/lLl3UcGFBHVVEq3KMBB2drZruvapDUSCwDUwrBzKdbiqZoQwAeGDrdWt3j0VewV2tNcwf6njVQut/mdXeUF5gOaxpRJyiQZZjDGKIlBQwytAZ8jlMCpKxVNfpord1/j+dINJtyhHMDBV/vhZtU4n7cvRMkfsshOsxhh1CDNltqkCy9XjF566YemkRx6Nxfh6uzw230EcrP6pMCpSVTd+O5U+NO66YtEZ60J2fid+2yuWqoMhtGLFP60J0d29b9ntcYNPvem7sALKcrsiOYOh2jHRKdQPj4IxX2zl+84cFnlifjMYd8VNMpk+UPn6OJpJvrWjGjlciFTiyuN2de3ugHwVjaIxqBOOk6e4iYPKT38/7rzCXk2LtK2gJll/78zu+r7J/ENvKu7UpEP+yx1EGTjy8cfGS0dReTs3EDBoENKihZf2M+0t1VjnFSNND5Z9Xyu51T//GfYpw0+B/WXhf/zoW0MEcj1RfX6u3+tK9OPoXWiDroRvRm6ESPRmspT1AIHdg08/GX5GQkcVC/mt+BArVzu8acbjiQU08E7Ff+HxU7BxHcRZii6qJh8MyF1vUM7lhjc1bJgDfrPXzmQ7Ml/n3s1O7yaqnqym4Rv/byoq3DXNc8vPIC8i8f5mSnYbtvA3wLp0qdyvtyIlY41GwQi0qbJGm9cG/XBX5g9wytD+fl9HO/KpwdqJxRxcahXu3oSo6ePS9WgdkqbnmfvKEu83WmHmboshsLECvVRLYwceQ59zz8iLTh/3pkx5yMH218iyOXQvyWtCGYlCsdttSFpDvG2Yh3+UDdGg6kLheDwZE9bMqPBbJDzP9/iKYL/DX+BJjW7JC9DrjlVLMvfxtEjJYf5F48RXIB2/46R9btKzv/KPpZDxwE1xrgs7txEua1k50W8DWy7HBJB3lAh+hlu8RnjA6Lhsuq+p6ZWi1uA1Q472QX0A8Cf1VxrBCO/RSEibXD1vk997BuOSlFG+fO79wu6PtbOVKdNgyeRjfGgkDMWbnm8UGOCNU0sukKo6CKccE9hnSJuEE2dGnH1SpJOLThzicQ0q3YlJr7lvxO0QT2O1F7sXulkkslW/T3Ym+4XtJe2i8TW55LuRIEsFAEaV7MMQUau2/tM0pbWpd+btpBsARQ/jq49Ca8BI/2gA/V7VrPZYAEiSAGS+M9MH1ocPEaTQBYKjBL2eUtJsv8/mkWT+UYlGeHfjJHodDrO9J2iYa1Pui04GgJXaTv+lusQzfHPbfSrg+k1EaXkhpFxXtj76OPf/qU3RJXCW1+7wZBUZMMlY+txxERdZS5sKM3m1xtc1yEzWS/ZgHlSseJZLy/9xUICxDQxOURA8w/zCp3Fak6Sk8sJ0NdenDBWrhAnB7m3jeUL4bdKuvgZ5frpmbDkfgcvWmdpbPw==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LV0PR21MB6623.namprd21.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: bed76295-55bd-4497-e00b-08de901fe4a2
X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Apr 2026 18:52:58.6948 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: FxC2iHjw2QNgPa7hfkCBY2YpV38f266VTOVIPhYphHtCvhNkoAmAvuSyEiZhrA4E22peD/ZBQ8sN/TxYQoydYQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV9PR21MB5359
Message-ID-Hash: SKQWJDGWKIIOWNSCYPRQ2Q4D5HQKODSQ
X-Message-ID-Hash: SKQWJDGWKIIOWNSCYPRQ2Q4D5HQKODSQ
X-MailFrom: Andrei.Popov@microsoft.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/B1A8qXj-5RlJ-MYN-Pu9ARxLMxw>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

> So what actual problem was disallowing clientAuth intended to solve?
I would invert this: what problem does a public CA-issued client cert solve? When is it OK for a TLS server app or service to trust every client cert issued by an arbitrary root in a SW vendor's TRP?

Cheers,

Andrei

-----Original Message-----
From: Peter Gutmann <pgut001=40cs.auckland.ac.nz@dmarc.ietf.org> 
Sent: Wednesday, April 1, 2026 3:02 AM
To: David Adrian <davadria@umich.edu>; Mike Ounsworth <ounsworth+ietf@gmail.com>
Cc: Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org>; Tls <tls@ietf.org>; spasm@ietf.org
Subject: [EXTERNAL] [TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey

David Adrian <davadria@umich.edu> writes:

>History has taught us that commingling PKI use cases causes more harm 
>than good. It is a consistent security problem when PKI hierarchies 
>intended for public web sites get entangled in non-web use cases. As an 
>example, such behavior slowed the deprecation of SHA-1 in 2018 because 
>payment card terminal implementations and their corresponding root 
>stores could not be updated.

So what actual problem was disallowing clientAuth intended to solve?  I can't imagine any situation where doing this is a good thing, but as others have pointed out there are numerous situations where it's a bad thing.

Also, for users of said certs, is the eKU in them critical or not?  Its usage has changed over time from the original "non-critical = advisory only, used to select the right certificate" to the more recent "both non-critical and critical are to be treated as per the critical text".  I'm not sure if this newer interpretation was a unilateral decision on behalf of the RFC authors (it looks like the non-critical text portion just got dropped from the doc) but when PKIX debated it there was, as was typical for PKIX, a 50:50 split as to whether it was strictly enforced or advisory only.

Peter.
_______________________________________________
TLS mailing list -- tls@ietf.org
To unsubscribe send an email to tls-leave@ietf.org

v2.46.0 | Report a Bug | By Email | System Status