IETF Logo Mail Archive

[lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey

Rob Sayre <sayrer@gmail.com> Wed, 01 April 2026 16:31 UTC

Return-Path: <sayrer@gmail.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 169BBD4ECD79 for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 09:31:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775061107; bh=x2GCHxNMnSQd7ueD/EBhjfAn08jkbUldWnRZw/+aKRo=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=SiyJ+vOZ5qOvppg3RUnwKwZF55ngV1qh66Khqgks9pCUKgB95wM9APhe1DQE1mub3 7Y2sCP93Gu6lVWC8jbkIbyTvMGnrDjPQVhALSBkyvMxjMW4RSNtVwJDA2RNY3usb4A myGZGERPqV9mLEahQBMYqEdMMzKNYhI6MXhEBaWM=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ATOrrkW-uq0g for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 09:31:46 -0700 (PDT)
Received: from mail-pj1-x102a.google.com (mail-pj1-x102a.google.com [IPv6:2607:f8b0:4864:20::102a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C0130D4ECD65 for <spasm@ietf.org>; Wed, 1 Apr 2026 09:31:46 -0700 (PDT)
Received: by mail-pj1-x102a.google.com with SMTP id 98e67ed59e1d1-35d9827661bso2406672a91.3 for <spasm@ietf.org>; Wed, 01 Apr 2026 09:31:46 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1775061100; cv=none; d=google.com; s=arc-20240605; b=iqX+WVfxPenmLAHOfk7nraBG1V2M4ZURvTsdnYa6p7tr+y80QFWBEZcL22LkF1wIMx 20DOZrNUyT3qiDT8DstmPtlmPLEo39uC0u9GFQTED4QtQjmRMEaAkT2W5UAHHHjrp6r8 W1Jte8kIsq8OYxSQhPk5/Ix3bwmcsN3CjE1FMLSRnqUgy6Zend29RfzCtasTL9BiD5S5 ptl8txvImLQVWQwLh5FmdAqymQZHolrrbkhfG3+8lPXBbo0QIwbCsgpOony7YG7Ylv34 FFQihsVs4A9e3Vsi6qWefd+wfQYlSFOoRL5Ok06b0UG2HWsTrwVIXhXt/gyNYdg+ibnz 2MaQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=x2GCHxNMnSQd7ueD/EBhjfAn08jkbUldWnRZw/+aKRo=; fh=4fqhO+lMbH6airzNu+D/LVRq27K4uuM5L9jzWMkNwmo=; b=R2+jT9IawKOhxKC0Z1yTr3uJTaaoXx8Oktcnd2oXOJtXCjfRXcd43I5jdZHxTgg9pK 2ltFMkjfdLf73eSR0NEK9Src/XBkQU0q9j5z8Xe020n1BOuMvrrBGstuP3/yl287JMBC ZjihDRKS2ERfhoulHqWDfqNYLafYWyNiXdUKRIWI66uATq6L0GmqWCjDhg0fH3VcwDZO rQ4OJKeU/1pobu2Cb68iYRPlwuMMDL3eeJadoDmx93yFaRbTaiX3bslRm8qlHvXVClJO M6+026ihNCi4HI3jx6zFB+ezKEsMIBu03rUOn0tJfquuKnuT56P1jYdedJLGyqaTwr5J FLgw==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775061100; x=1775665900; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=x2GCHxNMnSQd7ueD/EBhjfAn08jkbUldWnRZw/+aKRo=; b=Z+dptCmydICWgflITfLbuliiWqqHFr3edxopucv0FcPSSbanAdfguB86udh87l6h3Z V0KKI6TNPeL797hHQ+KbCs2FQ3MR/i+UAwCzWCjO0PalqAj3HtOINxjwjLj9HNI9jY4r wh7iOhHhTsoH+HXrlmVHnFzzy4E+uLpv0FRIAlE4IeEiJQTjdgcoib5HXyjBXs2FFyCC 0X/HoWANNiaCwL13TAlCTGIyWQoc0DmZdnm+Eq6GRPdIGnslxwNG7TMK57ufLbj6+MXZ 2PcTmTBcZfHUjO7D3Hsgn4GG8+Tp92Y8ByaJ1efGV+0I6f761yRPH51gDKz+43wdQRuK RJ+w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775061100; x=1775665900; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=x2GCHxNMnSQd7ueD/EBhjfAn08jkbUldWnRZw/+aKRo=; b=bC4WtFw7xygWznzbGPBYbXuWWhv+gz0NG+Q7dhX9aa2ZRbGNd7D2ypdg/Kn6ENs1v9 Z1jAGmehEwxtAuNtVgGgYQZwGMyUO0pYlQsk5lgx/86Lp/gNdmNC3Z5q/jqoHnYB9maL AGCtKSk4dpc3y/vkACwr8hoyZfATvuHwZbFVb/X7ZjovD4CiVWkEt+JWogHgFkP/pLPx 1p1wafD4avVszzBOkyU94DRbRdThKYiO5nOSO3qIdabnyt6sVmOoqy+l+RVIqFFKX6X8 ACkQ2gc06mfINT4vIIQaWjYpmHgJafBkbTToqZgicSf9Qt+4xUyDO5gj0J4dO5aBOKPX Hzvw==
X-Forwarded-Encrypted: i=1; AJvYcCX5z8f3lf4OCbHAkX5vMWJ95StHgOPcB2q66EEOO5CtG1Baj2cz7sluDA8hSpKnxQOmE7bRZQ==@ietf.org
X-Gm-Message-State: AOJu0Yx52dMZtZTX8tUieV5GzaPG7cVqoerrcbOFjsVgIWDneEclzrpx HLfo+zuCEyvTAHw+sP/Kq1vYv27Jd3iyiXvWcBIMtVoV6EMmcoxlPAU7phMor5U3PxC0U0L1s9K dnCH81zNO007RnijwAW8KFAkIhjbNi72EuCeL
X-Gm-Gg: ATEYQzz55R5nufVa0KvjMMmknCFfPIqaasPIJSC6S8bFVbrygP94bbVBa5FBiexoYm2 nkF+DNX5ogYXzXx115hDqmUiIBHF4j2KcAzqEYXefr7kk6Vqu3TW3RcC4g0zqhupUam6KuqZQHB IdzwboplN9TaJmYzNwVg3edD7E4tXYg1w5+SFkrvdsdvRdacUMLhl7CtVHxS+LKjrJV86Th1im3 Ia4kmWlLK77k9X4xau+AvHPqlkiDGvMnD2eDutS9k4ZIl4fjLyBAQNFai1lEXFhoYoCbHAWzz1f 6Wt0BRZLkNy4mOblllxmwB/hquk0/eXLZQjGGopYfce2nSyj24I=
X-Received: by 2002:a17:90b:288e:b0:35c:812:612a with SMTP id 98e67ed59e1d1-35dc708e0f0mr4116317a91.29.1775061100162; Wed, 01 Apr 2026 09:31:40 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <ac000NJH3A1MaZR/@ubby> <CADQzZqsT0qrCyusarQY1AK6w4M8jSbA8V-f+va7U-tv+KMUd1Q@mail.gmail.com>
In-Reply-To: <CADQzZqsT0qrCyusarQY1AK6w4M8jSbA8V-f+va7U-tv+KMUd1Q@mail.gmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Wed, 01 Apr 2026 09:31:28 -0700
X-Gm-Features: AQROBzAsLLG9LUZI0_zVhR1k7_6SC6WVtWfUho0G7htDY_MBCJAcw459zDUU8k0
Message-ID: <CAChr6SwSSwsaUHBCVUZ=Srzeg9FQFS-DWM-6V3j3XycmEwcyUw@mail.gmail.com>
To: Mike Shaver <mike.shaver@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000547110064e689e92"
Message-ID-Hash: BXPVF5VQGPP2M46M7BBB47NJ65ILOS2O
X-Message-ID-Hash: BXPVF5VQGPP2M46M7BBB47NJ65ILOS2O
X-MailFrom: sayrer@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Nico Williams <nico@cryptonector.com>, "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/Fk6M1qRGma_GcEwNkZqcMYSgeGk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Wed, Apr 1, 2026 at 9:11 AM Mike Shaver <mike.shaver@gmail.com> wrote:

> On Wed, Apr 1, 2026 at 11:08 AM Nico Williams <nico@cryptonector.com>
> wrote:
>
>> I don't see how the IAB, IESG, or IETF can possibly accept the program's
>> policy change
>
>
> Why do those groups have to "accept" the change? Do they commonly review
> or require changes to browser root programs (including the Microsoft and
> Apple ones which are aligned with the change to clientAuth issuance from
> included roots)? I've been quite involved in WebPKI discussions and I've
> never previously heard about IETF or related approval being required or
> even appropriate for those programs' policies.
>
> Are there other elements of the policies that you think should be subject
> to IETF approval?
>

Impeccable timing. Let's consult RFC 8962.

https://www.rfc-editor.org/rfc/rfc8962.html

thanks,
Rob

v2.46.0 | Report a Bug | By Email | System Status