IETF Logo Mail Archive

[lamps] Re: [TLS] TLS Client Certificates; a survey

"Salz, Rich" <rsalz@akamai.com> Thu, 26 March 2026 13:05 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id C8ED4D1C03BE; Thu, 26 Mar 2026 06:05:34 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QoJ9mNEYa3Wg; Thu, 26 Mar 2026 06:05:31 -0700 (PDT)
Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E7EB8D1BFF7F; Thu, 26 Mar 2026 06:04:25 -0700 (PDT)
Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62QD0w0x1893693; Thu, 26 Mar 2026 13:04:23 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=jan2016.eng; bh=VwTkGWSFyWfXLabf1+l6JQ bXQmjoYXq4yrddKzPSQgs=; b=NnsZevU5sLUgJgf/gmh5ls2NsY5imPemcjKehb dzjT6eRNkJeTgdQ11VPViKLRw4uY4L9yvlTJklOzHnOVV5G++vqTDjJTGw5annB/ VMPtw0W6nJ5fATruNKCxX21znLV6dmTS+6OWNSJk4La/OcXTUid41HDsb5L+ayWu gan3KhFq2by68vK8sJU6wLhsCEMI7vHFgz0/pB/VWxGxtFXGYbhrzcofKOIkG48X LH8hUvyMhCKcsQutIeJmmcF92AS/PeOJqXiDjDcTAse4uukcuc5llGb0p8fsyyvy bephIKq+4mgoQZXFqfh6cf82fgNZBd5fr0HWQZzcHFgh6MpA==
Received: from prod-mail-ppoint4 (a72-247-45-32.deploy.static.akamaitechnologies.com [72.247.45.32] (may be forged)) by mx0a-00190b01.pphosted.com (PPS) with ESMTPS id 4d1kfc4e94-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 26 Mar 2026 13:04:22 +0000 (GMT)
Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.18.1.7/8.18.1.7) with ESMTP id 62QCnucR003549; Thu, 26 Mar 2026 09:04:22 -0400
Received: from email.msg.corp.akamai.com ([172.27.50.202]) by prod-mail-ppoint4.akamai.com (PPS) with ESMTPS id 4d1pnus4vf-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 26 Mar 2026 09:04:21 -0400 (EDT)
Received: from ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) by ustx2ex-dag4mb3.msg.corp.akamai.com (172.27.50.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Thu, 26 Mar 2026 06:04:14 -0700
Received: from ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) by ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27; Thu, 26 Mar 2026 06:04:13 -0700
Received: from CO1PR07CU001.outbound.protection.outlook.com (72.247.45.132) by ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27 via Frontend Transport; Thu, 26 Mar 2026 06:04:13 -0700
Received: from MN2PR17MB4031.namprd17.prod.outlook.com (2603:10b6:208:200::22) by MN2PR17MB4077.namprd17.prod.outlook.com (2603:10b6:208:20f::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.22; Thu, 26 Mar 2026 13:04:11 +0000
Received: from MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7]) by MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7%3]) with mapi id 15.20.9745.022; Thu, 26 Mar 2026 13:04:11 +0000
From: "Salz, Rich" <rsalz@akamai.com>
To: Nico Williams <nico@cryptonector.com>
Thread-Topic: [TLS] TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7XAIwCAgACtdj4=
Date: Thu, 26 Mar 2026 13:04:11 +0000
Message-ID: <MN2PR17MB40317BEEED6217B40322FDAECD56A@MN2PR17MB4031.namprd17.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <acSdA5dgEpvgxxtR@ubby>
In-Reply-To: <acSdA5dgEpvgxxtR@ubby>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR17MB4031:EE_|MN2PR17MB4077:EE_
x-ms-office365-filtering-correlation-id: fe5069ae-d837-4b57-6f73-08de8b382c7c
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|10070799003|8096899003|38070700021|22082099003|18002099003|56012099003;
x-microsoft-antispam-message-info: 56rmtmji7KkB2ZFFxfp9WWWmOMuvMTRtz3CdpUvqfDmqtg9zOW+xURs78AR5GMIyqig24/BTPcPEwXkGW984w0/RY+oU+7Ztd/NohKhDaYigKuVaiDbrGaICC6AmVD4PvyNzcaSxwVW3KDZYELtYknZ7vns2uc3UHLw+XSkwxJhczS6qXvNV6s/u+Ul4scY+iyuWSnzurDMk1ikcKxkV0DxdDtqh2OYJynpmtooInmCrOhv41ZE4w5ynfT1RmTuenCoEUjmqePF2IBkHndOYSN0L5CYCoYrOVPpUX3kkqNq2zjqI6z8JSR+VmYisnhXd1F/FHAZf/mTlUmd5WskoJ4A5LRM1QjnwkRKBco3IgS6pHNV4l/BGyReGfMPEIXqhqE1RQKfVc5ERLkt9sSzod5QM868MlENk10b0XlloZekSQ8cc8GgVks7JTTFs0A0EwI3XsnR5nr+PZoTE4G58JyW5jXz9kikJPXYkmk7lALPKIjbVRMJ6AbVjX2pLvuFoZ+A2mgSAp/aQzbPNBPSDyRQiiVXr0IDVY9mdY1t148+uE9biMfc8xRSat7Rid1tRpOJxHUUNi5g6LRDXWhK8NSNwDROvuxCIMmoNjs/9lM2Q2BOjQd6H0pfxi23WHPKDYs8TO86ucwnzvJd/ZGtjFCVGs1bJjuiaeHKk+m5rA11L5HAmzVp2edfZoJpZtmRlb4M27tu2XlyMpFiYHzZeCjNWG1mrq1xOXH4XelpajxxN2tz2LmysHNV6sjqVwIdtPbkHr2RvAd8FZRakQYumcaevjbz6QRhmWu2DRplyypg=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR17MB4031.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(10070799003)(8096899003)(38070700021)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: HcXcCyzONhfkv2AdzfrJR/u054UFOl+n47+QlpKOpO9GWnV/2S0pfJpHlEYzZCXEtIWWZ+MVA4tJ6DumLPvX0e2ghFU/gullD50dMhnTYBaMbbphQZwb4mttxH6GxQEcHlHC06MMHOU+tzq7wlRzTiKKocxqF7SlIXCKmaZcZyU3sF31YLxNmJnVAAk2j8PJaHlGTW7yM7k8ICA4cBAV1/ZVb+mNl2six61I/VaxhsIX7bMUgubIE4YXIXorhXsrC/1Mdur2wwHgaGa7kqNRr32830/TDhey1OTkcnV1u8+AAkO2ngHpuIaFzzPVuYrOcDVExKoo2CdfQpGD8cpglANRWVZqRqVsKeZ047JbBNHPn6+54WDOrb/R0y4vzPIpg0h/IHNCCeTPSHT/7ASscGkLMnhOmf5js2tnXFuPbbpXYU4TMCND41oXr5/QDtbFGoHpkdnWyU7do8WlQR9QGSzomr1GWexg/rY+gnHx5EXTeaXka5y6TTtp28SAiZRc1AWJKMaPqcYiLjKykY0Cqff3TPjCx+WEMrR2aq+A1aEGRSwGEEfyprOTQHEbfsI9Q70fhcZZaRTKqOpIWpeInOtDwcGwYn3SgoOPHu+U+xlTmnX/UJct7f+t/MLFXDA9LUd5MkgqXPxOXFh+9TVDRtgwKktJWxEAJWNYWriY6Xvw9AKvOYGI2I+c//ziqILhDpqc/cROENCRg7QYnbUHKA1y9aYQChJWqP8WasTbAtr0vxmiWoEssmlh2zdCPF0EATLwqYtG/rs3728j1ar5KCzBw5rVGMhP9o0H7RqCO1zMwt8Vh0uuTiqWS8ZBexeJDXQC9l4GarBqJWraaKdzSTretfPnnyKyXQ2hi5OnQLcIrPZh81DtmbbX9elgonePtsLpmDcNAUpSbvjlwy18lo5ovegaH/e+0liR17fShZywVjiRjnn9c+a+Yo6EXt5zrcCKN6tSwwyXkaRR8PNlPfrmxcdTGsCkEGh6qJE6kv5cBBhk2vBmUq0oXRugFPVJSwlTZw9m33WqpDfVvNQ5ine/n5W0ZMc3zfZ2OnqvXz7uA7cE1JqQxZDPaNJ8NX7/DV5tFLm57gGjpR4WTMh2873eiIpfXFiAd1fjEpfKa3Eou3OVYSsvUq/808fKqPQXlh80q76rruvV5D+ZLBVhdIRa86SauZUfesotfWemyTZ7dMfOccIuzwp73a9LFH9RJuVdyL7/RjjZ/bTRXd25z/4sDcbdwZT9TY54wV1NKnEwSs17Ck6t9Mw+XKwWQVvf0rwuEhDu9pK053j1DRbC4EXUcFmRoNCaKQXscABN71KybeAnXRoGKpZJuoKu144h4dAM+BFtVBHrRyg3wuptd7+xtEub2zIalsCGaplWePQ2utw9Smn12nuE0NF5X2mveqQBG7DH0NZ0sproWfCB380oCSOo4m5axnH2qkae6YVbd3umXKWt18s74KzNd8zSASOWmMS/b4DyQrIH1TbQBVHBY9gmBbuSsPigA6PF2WkC0Z30A0H0/UkBHar8puOtNYSuUOzMrYBtAVFbbCX17+qYhHnGs0JgBSuw/3fzuEvtPipJZnZFxQ0TUxMRMD6xvS3tDEqsc6jPbsRb9UtLxGQMnb1fkzWr3LjYPywd0mcqd8rrCjK2r6CmTcPOtIhutBYfguFIg9Bx5Jas+hM3/O/f2XwmS/0mDKYljdofGMksrnVjRkUgwW9MtahaYPV5NRUY67K4Wywk9fk9DMfT4igdJgoPSFjA++TfTLm7gGNZUs/e1E3cQuEJRw+H0IdvTN9h10JS
x-ms-exchange-antispam-messagedata-1: uOiP4XQ/HFw4Xg==
arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=y2cD0uSONZnmqso0KFFK1cALgJHN+Zz1p0RskiyBpPIIX4nEYzR+G7tmkvbPwFV68xtt3MpihTycXQR9noc55n9NYSRXScY1937QhsOEcFKuy2LL+ZhR8ZPvz6T+YfVwIVfY9nwOvoVIIrevYh+sTZQuwnXgUXDuSF27zeUWjNU3gNplqEHQRVdCLd9Efz/QkW2AY2WaRhv5XLo5vCz4qefcMAGDpLichiEkiEzFtWs5dGMDJIu8mIHn+bfniVvByl3gzAKaVBQGnjJi4sFT/6FmDkzpJDnlGBzxL9wVe/915K/XMI3JODqT1Hgy4Cn2MPfWwsCYUudusUH1nHiwgw==
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=jIJsl0NfRorQqKe4v6KYCohOTm4Uw3dANiyzgSxFuO4=; b=UfYCcJOoAwygMscFbNH8dGs9JRsXKgBNdPEiXd8NEhx0i/Z4IocBadDIIPSnHu8PEDbC9PgfZ90qvLppRjPqKt7jCwxW7V0dEYN08Ou3VStIaiB+H+3clvd7BSFpsWbP1JWKRr4lswKQVoo7GukA5I4hL3F0hlCYCMDXudfqt7HQZjLBVgl99uyeqh1FfbbM3Yw/yUygBVboprTax+/pm8ayMl9hGX+W4fTW7GEoaSG+TUo6TC3urcDnGw178CmEbcdCNCiD3llW4bo6DxrOt3vCp94kR7279qqlDUPpWrmhSKflElAAOf8lHzV2sg9l23USKYPFcWEcRh5OAJRyHw==
arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=akamai.com; dmarc=pass action=none header.from=akamai.com; dkim=pass header.d=akamai.com; arc=none
x-exchange-routingpolicychecked: Pb0MEsOry+THZL4PU6j6iYZhrn6vCpaAF8wMsGekKtfQ95c/5h2fdHXAF7tJvj9z545AxsmZQkRVKLY1jupIEYtlzSjTS35u0LxpELDxtdmGpCm6uBwKqvlCJTSuUq5dKpURkeOeAZje2DlMWM0gJ7tFzWYThd7vOaybyD870AVLGn3wtsb0mkRUogdDNZIMwR9uvTh6bhhLtm4dzYYCx6RXIEJwgUtzukLRKufzgY3hvWH0RaN7BA4CcKI3CgeqXO2csfF24f51HSNKyF/SQkr/c9nqS1j9KEThRYFnp71CZuIwWftv9Tj7FLVLYLnR4pWyHhHMIuLcjj5CPhfP9A==
x-ms-exchange-crosstenant-authas: Internal
x-ms-exchange-crosstenant-authsource: MN2PR17MB4031.namprd17.prod.outlook.com
x-ms-exchange-crosstenant-network-message-id: fe5069ae-d837-4b57-6f73-08de8b382c7c
x-ms-exchange-crosstenant-originalarrivaltime: 26 Mar 2026 13:04:11.3387 (UTC)
x-ms-exchange-crosstenant-fromentityheader: Hosted
x-ms-exchange-crosstenant-id: 514876bd-5965-4b40-b0c8-e336cf72c743
x-ms-exchange-crosstenant-mailboxtype: HOSTED
x-ms-exchange-crosstenant-userprincipalname: UFcc2K0p3NkYl9Y70EESgRtH8q0Oar9gacYiCi/64/2Z15mfguYS4fJG1qy4JK5XUFzPS0G2ec6moKkswkMLWA==
x-ms-exchange-transport-crosstenantheadersstamped: MN2PR17MB4077
Content-Type: multipart/alternative; boundary="_000_MN2PR17MB40317BEEED6217B40322FDAECD56AMN2PR17MB4031namp_"
MIME-Version: 1.0
X-OriginatorOrg: akamai.com
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-26_02,2026-03-24_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 spamscore=0 lowpriorityscore=0 adultscore=0 malwarescore=0 suspectscore=0 bulkscore=0 mlxscore=0 mlxlogscore=777 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2603050001 definitions=main-2603260090
X-Proofpoint-GUID: RT2z-aTrF3SGRfc3ueWvd3TtGmHUX1aK
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzI2MDA5MSBTYWx0ZWRfX7w5OYBokG2m6 7qcBtYrTDIP4NPHNfwX/VPA6NuBxtVPYUcmVjYJCf6GbJ6PGTZ0i7QwHdLGcrSGugXBQKyyrHe6 H5e4xHpMMzgE/U2kSvR+5UUxkCU2diunM6yJB114ApAEa453NMr2sx6JgalQe+nHO/Uh9zY/e3O BWih0LJ1SMXSXjEWkRili6ExjUl67YeSg3iNBie8D+OygV9fBm8vGgtspcvnQomARn9FNLfPsHO Q1z4xqDPLxzYKHMHsbWtszgIrWzgPSe82VZRclb2HcQ75YvStHohevnudE8zLhPljWPmEdiu8ge WOxwUFgWFLklyAJFGbRErWpTojozM2rrhvm5JOVDgg5tFHAK3CEi6LtWGs3qWAAcRdXSiNEg1Yl b6/1DhDb5q6ztFYjCvanqYkuLq4FVGFv6aJ9faua0Mjn2qOVcWBUJGQvPb5EB1eDBAWNnlq3WLQ MVHXNSmxGHFAldyYmtw==
X-Authority-Analysis: v=2.4 cv=e5U2j6p/ c=1 sm=1 tr=0 ts=69c52ed6 cx=c_pps a=NaJOksh5yBwW9//Q5C/Ubg==:117 a=NaJOksh5yBwW9//Q5C/Ubg==:17 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Ifg-1AOnLHOf1gn6spyb:22 a=5uIk5skAYop0meUMGpPt:22 a=gAgyh7RkmNmCURGTXOgA:9 a=pILNOxqGKmIA:10 a=UEti13qyq00wtXbUZawA:9 a=JCh7uIHm1nQXLyW9:21 a=_W_S_7VecoQA:10
X-Proofpoint-ORIG-GUID: RT2z-aTrF3SGRfc3ueWvd3TtGmHUX1aK
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-26_02,2026-03-24_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 impostorscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603130000 definitions=main-2603260091
Message-ID-Hash: RUXV53MNV3GGG6HNRLF76Y5FHNGHB2AI
X-Message-ID-Hash: RUXV53MNV3GGG6HNRLF76Y5FHNGHB2AI
X-MailFrom: rsalz@akamai.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/Epbtch6MkBQjpd_K_uW18v07szg>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

  *
Sadly that registry is for a specific OID arc and does not include
  *
extended key purpose OIDs from other arcs.  It might be useful to extend

An OID is just an opaque identifier. They don’t have to be in any specific arc.


  *
Even so I can find no EKUs for SMTP, LDAP, IMAP, XMPP, etc.  A bit
  *
surprising.  IMO a number of EKUs should be added.

The LAMPS WG is the place to start.

v2.46.0 | Report a Bug | By Email | System Status