IETF Logo Mail Archive

[lamps] Re: [TLS] TLS Client Certificates; a survey

Viktor Dukhovni <ietf-dane@dukhovni.org> Thu, 26 March 2026 13:12 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id A26C5D1C1648; Thu, 26 Mar 2026 06:12:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.398
X-Spam-Level:
X-Spam-Status: No, score=-4.398 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=dukhovni.org
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AMXcuehZSu8M; Thu, 26 Mar 2026 06:12:22 -0700 (PDT)
Received: from chardros.imrryr.org (chardros.imrryr.org [144.6.86.210]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id F163FD1C1640; Thu, 26 Mar 2026 06:12:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=dukhovni.org; i=@dukhovni.org; q=dns/txt; s=f8320d6e; t=1774530739; h=date : from : to : subject : message-id : reply-to : references : mime-version : content-type : in-reply-to : content-transfer-encoding : from; bh=PYypx2R8B1YaWdC0z1kfW/3hytR3waMNWz4rBE+hP0c=; b=hxlXU7yAgbb9sPchpSRz6f+Jjr4WkedU1aoUg/yjwzyTM0D7i0sDrgfronc71oeQSuq8o WfinYq/dVeXdxkv9/MtKxci4InLkRQ93XtxaJ2l1LhPkoMEmGAl4Rp6+qwxQk+NNR2XUe9Y zq6Cf/mA7Cg8g3m+IQEgJI1GlgBKsCU=
Received: by chardros.imrryr.org (Postfix, from userid 1000) id 13493938E14; Fri, 27 Mar 2026 00:12:19 +1100 (AEDT)
Date: Fri, 27 Mar 2026 00:12:18 +1100
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: spasm@ietf.org, Tls <tls@ietf.org>
Message-ID: <acUwsrXBdHNk34rH@chardros.imrryr.org>
Mail-Followup-To: spasm@ietf.org
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <acSdA5dgEpvgxxtR@ubby> <MN2PR17MB40317BEEED6217B40322FDAECD56A@MN2PR17MB4031.namprd17.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
In-Reply-To: <MN2PR17MB40317BEEED6217B40322FDAECD56A@MN2PR17MB4031.namprd17.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: W5JAZERDRRXHS772DSXZSEN4QRLR22CN
X-Message-ID-Hash: W5JAZERDRRXHS772DSXZSEN4QRLR22CN
X-MailFrom: ietf-dane@dukhovni.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Reply-To: spasm@ietf.org, Tls <tls@ietf.org>
Subject: [lamps] Re: [TLS] TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/F1nIyjKd7uBDnaFgCYcXk3k07hA>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Thu, Mar 26, 2026 at 01:04:11PM +0000, Salz, Rich wrote:

> The LAMPS WG is the place to start.

Sure but in addition to barriers due to LTS outdated software, there are
additional barriers that make it difficult for CAs to actually do the
sort of TOFU "domain validation" they do for web servers.

There'd need to be a whole bunch of new ACME challenge types that verify
control of the SMTP service (presumably on each of the MX hosts),
control of the domain's LDAP service (per the SRV records), ...

I don't see this happening.  DANE is considerably simpler and is
available now.

-- 
    Viktor.  🇺🇦 Слава Україні!

v2.46.0 | Report a Bug | By Email | System Status