IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 24 March 2026 12:03 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 5852FD09DA7B; Tue, 24 Mar 2026 05:03:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xGmsGwM8sDq9; Tue, 24 Mar 2026 05:03:36 -0700 (PDT)
Received: from SY5PR01CU010.outbound.protection.outlook.com (mail-australiaeastazon11022141.outbound.protection.outlook.com [40.107.40.141]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E0A0DD09DA73; Tue, 24 Mar 2026 05:03:35 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qnQrqS+FN15vMB69LgNY5/GIWp/2ed/esSxZAg2FL6UqIu9G4yLfy85BjQU31L2jfwPPGeitwvwlIyILPUFGlY/mDwzV0KlEntIXL4LmfqLEdb3S+ydW0CvEwnGW2vtmDG//GYZziS9IPQJz7ArdMHMTeWt8i6nyvn3N1IjekZ6sA3VrWhTdcgqsV+phc2OnC5Lrg/0Gbsu+X3j8m1iTNS+OXvKFRmRWqWCcPfNNov2OCMrgoFPnmaeSBQUCyDOIQ5wxBiFZDKuv3JcLA9M3wjDqEEI7M3EgPVneZLx9N1cttBaTLq3JHqEevcg2L5PprF+/O8m/0UDq8vVKRWDn0g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=N93WGQdVaForxO/hpV0gb39/ZF/BtdeHpYlmpjn6xCg=; b=zDV/aDFttfKaBFu/wgyQpWuL4V2U8Kj2A6lnWb8EDtIfvMerDTqhhtyXT9W95i0Qk4KUvRAu+w8wIsUN1yKEoxeHdY64FJJIIVcNeau7a/PfHtzSDNJOSQE0Nxb+QvGyL/k4QnbYUA0ntEXhMRRLUGvey0hWNv4RWp2GxQmuPjjFYPnYcdNBXT/6LYUmptsz7emp/298ZOeEASaVZQbcXf5t+I9tFCWa3UMCmbcq9JF3bQjMyQf3sojuHed0D8QEhtxX9eObspg4gkMCkZZWSgXMDOJv+8twnB7LQ/iXUTYNmHMfOlstInZ4BlVnP4bNXqYxRaxh2Yi5B5eGTc3Ysg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=N93WGQdVaForxO/hpV0gb39/ZF/BtdeHpYlmpjn6xCg=; b=bpkWKbAUGtot3eZgfajB20AikmVtTl4KINJI1lrnYr5WPqg2/Q6d0DM6fwREaJOdiwb00a110knedWJXDFfLX84N3gdZodLem6nKOJY5t9QJXc+GJx3Ifw4GnjxePBtrRGmc0N9fvjyA0tGv/lW6zGS1bPA5MRgzHkzQOymmv+jb3CDkhW3b0Pz9XmlzrV1LognFWbmRxlE4/CjTngYR9D6KrsE/60DArvXyKanp+A3UQ0qAScXL1mgs2SWvPlub0lQZL0sjAlgcKHCxMW7H2jP5cBjrL1odeKuIJIlYxxLTj5YXcuivZ64OSTrN7pmRTuWcxz0L+X6uV9NqgBW55Q==
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com (2603:10c6:201:38::9) by MEYPR01MB7299.ausprd01.prod.outlook.com (2603:10c6:220:15f::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Tue, 24 Mar 2026 12:03:22 +0000
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064]) by MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064%6]) with mapi id 15.20.9723.022; Tue, 24 Mar 2026 12:03:22 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: John Kemp <stable.pseudonym@gmail.com>
Thread-Topic: [lamps] TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7W9U/sLgABASwCAAAbDUw==
Date: Tue, 24 Mar 2026 12:03:22 +0000
Message-ID: <MEAPR01MB36548825D9F1D07B30B05D4DEE48A@MEAPR01MB3654.ausprd01.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MEAPR01MB3654202C8134AC3523991A7AEE48A@MEAPR01MB3654.ausprd01.prod.outlook.com> <04CDF341-5314-410A-BD87-F27757CD71D5@gmail.com>
In-Reply-To: <04CDF341-5314-410A-BD87-F27757CD71D5@gmail.com>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MEAPR01MB3654:EE_|MEYPR01MB7299:EE_
x-ms-office365-filtering-correlation-id: 477d36eb-12a4-4f2d-caf6-08de899d58ed
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|10070799003|366016|1800799024|786006|376014|38070700021|18002099003|56012099003|22082099003;
x-microsoft-antispam-message-info: cnqhHqLUjr8uBWVqvLVw3EHYoF65joqmKhoGwtu4VkYREUTr9xoGacc+Dj/eHpOVlWFlf+NmrVOv/MPbQa462Qnjk/Y4duJfQSfBAcyd991hsjmRNb9Yp/J7OwMBwSNAWzIV223fmaFDsLAZX/DEDdqG4zpxz8o5KvN6QLhlE8K/aR69ZsaX6RIpZj1vmzua77Zd9TCmQA49K7lmd/fvoVM2jBX5KZJIwgYj1QXRKmM1fEm5WJsYDQ4a9ijoxaaE2wXYMezqhEuZsh5+6hCHDJoikW1m54lsDGQ/2GG8OkVBdpQOM2eoIFsg/G8QYD92Rtvd2/s7u2VZr7GAlOzzABA0yr5ejgSyaMzEEZCcWxjbETo3n3I2/fnR8fvNghG+B/Lpxhkh66VCqPosB1fpn5x9fp/z7CHiJSJPkMKwOEXtuQ7N287ucznarfvDayWbAQhy6voFlnsCa7It6to5faJXkCGLSF/9Q+MQPVzvFETm7NL1tYQT9dQ0CdNzyN/7Yv0R/w6rrDswFyQ5J6c7Y1YwklKgOnzaQY0SQlV7/Rt4xP186UuUEzPEmT0C+1WkcPswyXOn9RenaOGTljdzxBW9gyPqoc4DGo25KuRfTY9637A4Bwk3HzQkyJ5rFrgXi+996Yyz+3ZjuU8+C/6OUyxFnSFXOH2zfzBt8i7y6HWISh0y3xiyRMtH0n4mqt+OCgFIgzuDik/RorQ08Bk+OCX/TVWp9w8yMMQpIvIeuSJHVSyHonXm6lCbGUZJXPDBBpNY9ho32pIPyqVl/yF1u3bIh2bRZeQWR1fOb9taul4=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MEAPR01MB3654.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(366016)(1800799024)(786006)(376014)(38070700021)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: oSPz2SAK28Td2rGOT5/gaJZ4a7KCEsAuWbW7cVn45C5J1l+/pwYykvybwETlRK+f1bUQXN9QEEVeY8hqLlS+ilvzXB7MQPxnRoleNEajOgjH3eR2A3WOEQxCUa6xYpod3sAFHZxRy2ZrCJnY3WgtwH3nAT7mHDOOakniV1y+IJKU2xBY7N2d1tVMGbqtUfy6dK4a/KWAGPNlkfcrR/x8Kso8jz/eNQbNE04oecflHLTDMkGn1u+VDy2sRgMtqt1tcUGWDNDU6p9vubuYxl+5owRZ8dRdDyxxfZJwG82hqC82T/oOnwXAcMVrWapFIn5kez7RoW4MTBiiHbfJFR4o7LhGn2e/CJSzPVSOPToGi15FUSUnOKRSkmFb+koWRRsVbTFK6qEtGmrPqqaaUAc3UrHgNOZAt8oaUonIfaVWHVMsFD9dfwQbbRqnCTDBz+VErOuUCuIOj32nhbcPh22z5PYcokBuC05Y0Mwr8OmRCNjlRNTGydBuHg4x3AcAMPExM4s6AWurxyLejVehe/atpqSzYP7RpNfrLUUDvB6pEhHNELQ+bHdSAzR7JaVCpWZKRtkJXGeSniowlpWOfnP8j0sv86CY36/JZdNtNGMhV/kjAXT3usSTU5W3Q4/m1jTLPX/GlaqmNOzaRc5KooX5ac4aDWKbfp0wLz3yAt6cqb+gxoYsiRcwHFmQ+NT2DvCVtGSCydRvzOdH3TapwZaJasCq4LMtMgO83tyNdoDXMb/fFBOtdUtX6HUdl+zA5OGlPJFVsAVYckcfWQ2x8SsX1MOI3yGOPU6kgHo/q1OQI7ySSuH5Ydf1xLauV+Jy8eNIi7pqBw3yTZRS6G3InZ/cSS5ytOk63bXKbmMzw0Ixn7SmXWkShYyUBLKTqZ2phFubXGrYQEtS5WcwTMtV6ZvZ4gpSpje1c1MGWRLmFvPQ5jOYBY20OXmVfsVKH8DVTVAmkDilYKLW0Dcr5JdUFlI1QFIN62/orlmbap65eyrTT3QjMgZ8wk4La3XEs+FZ/4sdVZunrWwMIGq25Hkm5btUkeHDcA+UPBW0PsofN9U75J13qQCtJH7liz9EL2sIu6CdIlaeI+rH3jJI3eHqMG2FpX/oL9W+xyHiXFT3kTYPohDBBHDk571eZeYxyp3BAFw2ndYmByeX55LmT4KMTAE7jX18n33RjMWSknxzwqDQ+OPjLAQoj0byUc7PFhG+drlJU4FXYIdzAD2d2FxfL8rwYEJS6nfFdMh/naBdty0X1JKYqHowuBPxJu3RcVrOGGxHwclQfFSLU6XSASxaSCLF4m0qgjxg8mINLA8LbUCl69NUWe4UqqJeON2tOpul+WLDgKu7hJyjGKhX7t9CJZmPxbjj3KcUM1h3qU1bV9yHzvL2zS61bmGZx8z+r+iUJComW5Bx0e9SJ0bY8TZ+5RLQxPrP+odXMBOwcHBhgvvh7gRp472atyWfCXDabETgkDmAcsURsVHelBv9o7Kah3hfnDn+sWIJ3NNpqK/Y2C8EYmUfX63YWID7l/d4x4D056JoTsH/Zn4VD6EFgQ4FQyK/DIlY0ki8auO3p6CGnCIYIxysA9wkv50IiWCZxqWybPygUuLSTbFFij3bmKo3PNNmDRRPNmH7ynjvbGKupu9ZnlF6Mhr2PTryMOxw4mveL8X3lPUX1terzTRqyPEiLldTpllUj7pCj/MCLo1CSt1VMK7AhiiJCB9B071NRcXBKC/yaXYbwl1E1MSYH4KQo9fLOPND4f3Ms1ZsDlW8CoKT/02fV2YZdXFCKgKv8OKgMOT04qS3bxHP
x-ms-exchange-antispam-messagedata-1: btSUvfWfKsYeAQ==
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MEAPR01MB3654.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 477d36eb-12a4-4f2d-caf6-08de899d58ed
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2026 12:03:22.7840 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: bbHLCE7BFV+VxNzQnoaHk92xOU5OvXQNA+77ZLMdS0eRF+itVlqp0PXPbIQwZudkXrBC+yghj1+Z02C5h9IHtjXOjRX649EdO6z5R/Td96A=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEYPR01MB7299
Message-ID-Hash: HGA5OC6LUIV6G4Z5DAXKDN7ZX3AA7L7G
X-Message-ID-Hash: HGA5OC6LUIV6G4Z5DAXKDN7ZX3AA7L7G
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Salz, Rich" <rsalz@akamai.com>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/Jer-6KHYCAC86tHoMOSeDSUM3nI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

John Kemp <stable.pseudonym@gmail.com> writes:

>And what is the advantage of using X.509 certificates for that ticket-
>clipping service, over using bearer tokens as tickets a la Kerberos->
>SAML->OAuth? Is binding the ticket into the encrypted session with a client
>secret, worth “PKI"?

X.509 is universal (technology, software support, auditors, management buy-
in).  It's the path of least resistance no matter how awkward, painful, and
liable to be misconfigured it is.  See also my other post about
bCanUseTheDamnThing, when all you care about is that then you just go for
whatever makes it easiest to convey bCanUseTheDamnThing to the other party.

Peter.

v2.46.0 | Report a Bug | By Email | System Status