IETF Logo Mail Archive

[lamps] Re: [TLS] TLS Client Certificates; a survey

"Salz, Rich" <rsalz@akamai.com> Tue, 24 March 2026 11:42 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 81678D09C018; Tue, 24 Mar 2026 04:42:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.794
X-Spam-Level:
X-Spam-Status: No, score=-2.794 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vKpo-uSDoHDT; Tue, 24 Mar 2026 04:42:22 -0700 (PDT)
Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [67.231.157.127]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 1E01ED09C00F; Tue, 24 Mar 2026 04:42:22 -0700 (PDT)
Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.18.1.11/8.18.1.11) with ESMTP id 62O3xbEY3348299; Tue, 24 Mar 2026 11:41:20 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=jan2016.eng; bh=GZZtLatgMDEt50Nk4tIZDT xSgtLDLLuyiqNU6p4i5r4=; b=kIKNHU5BXtj7SyaSoHnBNlwaDQ55KMbTBRVjxD sJXavwbLEOII59U1uDKnPzvOrXdXAL0EmWIA9JY7vdI48k9o+vKYZsM91lIa0cMP sfCboAc8Vr5huGhx7uvLi4TXx6s7k443pxT7/or0SL6XwrYIrwF5Y3s49Fjce/A/ DaUPqNQdgZq7gswpk6JcJshoqarppTM78VZf42yoOWwUsE2UqlvqsHL4yI2rNHMT oJYh2PWg8KNpB49gzYYjv/dJcx957CGwv6JMtMEDY6BOvQlW58iqjtHChDOuPPHG 1DudFmNLapHqv0kIZavsTYZ5PeRXD4MyKyaosdtt8+J73QMA==
Received: from prod-mail-ppoint3 (a72-247-45-31.deploy.static.akamaitechnologies.com [72.247.45.31] (may be forged)) by m0050096.ppops.net-00190b01. (PPS) with ESMTPS id 4d1mmc0ujr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 24 Mar 2026 11:41:19 +0000 (GMT)
Received: from pps.filterd (prod-mail-ppoint3.akamai.com [127.0.0.1]) by prod-mail-ppoint3.akamai.com (8.18.1.7/8.18.1.7) with ESMTP id 62OBYcDl021773; Tue, 24 Mar 2026 07:41:19 -0400
Received: from email.msg.corp.akamai.com ([172.27.50.201]) by prod-mail-ppoint3.akamai.com (PPS) with ESMTPS id 4d2s4j4vgr-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 24 Mar 2026 07:41:18 -0400 (EDT)
Received: from ustx2ex-dag4mb5.msg.corp.akamai.com (172.27.50.204) by ustx2ex-dag4mb2.msg.corp.akamai.com (172.27.50.201) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Tue, 24 Mar 2026 04:41:17 -0700
Received: from ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) by ustx2ex-dag4mb5.msg.corp.akamai.com (172.27.50.204) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Tue, 24 Mar 2026 04:41:17 -0700
Received: from DS2PR08CU001.outbound.protection.outlook.com (72.247.45.132) by ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27 via Frontend Transport; Tue, 24 Mar 2026 04:41:17 -0700
Received: from MN2PR17MB4031.namprd17.prod.outlook.com (2603:10b6:208:200::22) by SJ0PR17MB4928.namprd17.prod.outlook.com (2603:10b6:a03:3bb::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Tue, 24 Mar 2026 11:41:16 +0000
Received: from MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7]) by MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7%3]) with mapi id 15.20.9723.030; Tue, 24 Mar 2026 11:41:16 +0000
From: "Salz, Rich" <rsalz@akamai.com>
To: Phillip Hallam-Baker <ietf@hallambaker.com>
Thread-Topic: [TLS] TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7W9DbcAgACG2DU=
Date: Tue, 24 Mar 2026 11:41:16 +0000
Message-ID: <MN2PR17MB4031ECBD55FF4F337BE3DD82CD48A@MN2PR17MB4031.namprd17.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <CAMm+Lwh6mN3gi-EqOsaHrvKyWqoyexrWyMr640UFcHv0EtmXGw@mail.gmail.com>
In-Reply-To: <CAMm+Lwh6mN3gi-EqOsaHrvKyWqoyexrWyMr640UFcHv0EtmXGw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR17MB4031:EE_|SJ0PR17MB4928:EE_
x-ms-office365-filtering-correlation-id: 68f24c4b-0baa-4c1a-e6da-08de899a4231
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|366016|8096899003|38070700021|22082099003|18002099003|56012099003;
x-microsoft-antispam-message-info: /OevbV0+0v7LN4UxsPWsvn0PjsMIz1HkZRuY0s3hnDSKNayf+nP87O3qEB7KJEQOSzQWBGcS98ZkNaO/g3UEMvgWJrcsk2EaTpMM7ie2yAz/D+1Z2OQ36qK9p0NnXZPY7ZjL6DPFCn/YOhUpTtcMJp2bEgRAmg3FaY13bLVkAO+KeXSxroEnf6oeVi7NdyvnEmHt/i3cOzOMA8aJfe0NPFiD0nAR0Yrset5eIydzgAt0HER54aP8//V+Ya7KS2Z3RVen97P+O4KuU2kwiWKT/DI5ZBepNEqUVo9v4nyzpDoGNhrUW2ej8k5UrHdG5Ca0ASVkk0OQqZRvwz2/CXS7ZH5Zg1FzpuydADIgY7zq/UNqedMUZ1f1VRZ4zNOXhflnV8H4mN3UEdaSZTDrhwGZwTOwjhyJmpQdKQAjwwP9KvUTbab8Wi7CLzGgXaAG7JC550cmR3+gMJeCHyESRmtsCAzEB366OOTnvWZ/K3YHJnTU3odOhVG0QJYN/2BtGo5l5q8RJunPuLrsEwmIOk99jvdFMsFvDlTpMoIs/1QMqVAIge2xuV/oTedHSW4gFBptODRR5/lsuNNouwe47vtT70QK+fIOmr/mw15xnJ15/9bqg2rMQnO64+B4IdirBi7f7bCMteeOxESO5jBAOiFM8eZhfryH6RH91g6e4VLycMnyGreyB2cd/53h3gYHf9NBt1qiXyzkwCNANT9fH4I5FUTBBIqsHI4ejxTSRT5yVzBnD+xi9fnMQdPfrX1kfO41LBjzWwEzddbSCrM6OUa2C983h4E+JCeE8SZyG4vRvbI=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR17MB4031.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(8096899003)(38070700021)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: mRfI+xzeBzMkd9wZCAYtd2qBKd4rD60BXdpw3WcRPXKNw5EPTqkhx5kfAlj3Vtsu6jgLHKDzdoE8J0uASeBqT2t9tAOUplog/myudkEYyBBo5tG6sVyBTphcPC7a/uW7Fa3tDpW/jIa5nfUqQ4kxXbfDcxNT3xsy/X9PMFImXcWzxqedWYMHq2l/wx7cncexXAyc/mob+whAAX04Nynbt3Oa3/W9tNmD2UEWhytV2LGFpn72sEm+7kMGMo1onJHZactB5Azq97PcuAm7bsjdO9sibzMdNzXOGfu4p1tz/bOga/SX4SmMvO+Q38hpzvaLE6j0cv8qBxaynKrgVRpOSXYMW3pm/Nli5QQynIeFJBqN74Hp5/hEaUWTxybdARUH9F+7LBZRBQzQel79fDi9wrQpNIQsWVJdNGUmSITNxH70PmJZPgcDSUir7afbccQ1LElrmO/HhUMaqN10Hhxckc6/sKe1n8ymp7Oif9uI0XuXPexT8yTCBmZf+PLyp76n3pxpBM+Di/8QmH1TNjb5Am55Llpta5S9VfyE7pTOpZWKpjS8LW9SHwwd1wE9o4qjQF3OvR7jwLeSz8X16SqR4pKoezB1LHRXMjQnQz46W5mhCAh8+6LEI6Rp6MjdZrZcW4pNzNq29O46g3cPQ/eMnIV/DZ38sqD3Z1ugrjB8o+o/jHX25r3w4mEGg7fWeTpG9WavjvfempuPUZvfJqjkaXEo+WSg/IZHWl2YeADpHuZDA/nlXRSrX7vYE0Sxe2VcVm3O1zM+sUKDfjPzI44+4Hs9+KpnWMo2iauUs158JoDZSboItzmM4plJq22m4d9DjH0H3HQdPgIHhAGlN4CeO6/QBagSncnOvePqzdahdPFXtDIIwYDT6xIOikM3opHQ0ZkkNUNQ0GHdQi7JXlelNnraGwbFmCXE/WQHZAZgruYV4lrKClfthMPEpgduxA3ryWukvbbWLeKtLQrS5rm/RyWB+ljGhjmLv0mdOsAlGVSUxDvgmdtwTbbwpjjJ4oa1TS2dragBheb2xzAKnHhuyt9X1kz8ifXjbf8yJFI6EKGuhXXh20zkQiw/q2rLedm7Oa1FJF7xzLOHwoIv431qeskfOKP9EldbLLuKWNA1MBbQXW165N8tVM5qJ5soEuqrq8P5bfV7hkzVuzrqhYvot/WC34LF2zWS4Z0jEAgQnJLJZgUPDuPnI24YJCo3dzltFRGugh6/C48D52a/SxKPBKLfQ0N1izEd5RKOZHh9ux0Ukoe1QU1LYSs+2SfK5cUwLs/6wrUZheHWOztDDbtxPKKQCK9X2IhjDf++LZ9i79fvwdm1hkJ+rLAK5flxpzEF2JQsB1lcTr/UiABqAg8ikuWU5/jsGlwrnEpl02zC70Cx00co0aULr0rAh8rYNmkJJgRgWBgESEPM6VfoDI1fpfuHi1+EeDyfixAu81unol9XxkWfL8SSv5HuU65DomiXSX/ddQ2NaEZUAH2AYptTGBdcbVF5SITEEWDH4cQQ6HG+ch3JrdoVV5aA1e2b6Sul0MznjmgNmKTfyleJlAL9ZKYbIVP9PmRNhkJ29YlnS1Jz5pFEZEOyHfdDOZ+6yDnk1ga3bdjZ6qqUGBkm9xPtnfQ2I0n99kpm2pFwsQJ2V1HPG26vPoz09hrisUXhg0AeaUuP+Qg5+nInpY3p/ISdCw2gk8rJ5H8SaaD1JCOHxlLRlqQ0UTDjtZWLZlIEpDFttX/JTKJGKT06Acw/J0RQaQ==
arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=G/S+p4o6xKADrTtRReob1CwE2BNmZzZxYfsTIPlR2B17v7AfEpYFS7cDkSKxzeOwGIwgjgK44JQeg4gCxfC8UmmQxIUwwKER1NSmzf/4FquWpMNxnbYRjJDrlaWybPDi91ZeLJFJW+Zt4FrLsdjIUpctMGZ+oOoRc2++GuT5vK2IlB9dZ/lGrA375jRJizHN60t/lahBLve87xv8AsU4hl0OHSRZm1yBmBrPzsmT2f8mHLq8T4jszT+iy0Dst6UegCyEAJPTNjY4nQc5eql37cgPBnfHRBhmseWMYs332BxhDFz0fru15qolEClnmADnwlT2+7irQQXrjxSZNnmD9Q==
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Df7pZtLrF5i7CNk44Fe7kzQjiWQYLK5dFzwOOPle2oA=; b=sF27c9mPcidjFXMAhtOMyy7tfvVegJJpx8YIF30YWF9gZRMfJcINoxskwxu4JnnECwFeZvRqKLanXEFq3sf0MY6bGQ+lBcsZ4Idej3B7u4XCE9Rj0nlyeAMhI0GYIVqjuAZw7mGmrTPV/vI6WYClvro3kBBMNmaAUu1H99x+qyglyXK4PDZ4OKZN6DSQ8/iHoRg27om5pVPoJtYGc0V0lzYTCZvyd78P00jv/Nfp9FgYjEmTuzdkEvlGdfSsHjrjy4wucmpbJmtseH3Vz0da7T1HOrGWJ2K5QA/MhLBc/NkVa0t+cPEKkWFItWCsxopllGNfkw51IOdPv8igNJD6tQ==
arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=akamai.com; dmarc=pass action=none header.from=akamai.com; dkim=pass header.d=akamai.com; arc=none
x-exchange-routingpolicychecked: T4TGB/sLmK/WAUgrBKWuko+p84vu+/6+egBn2LROjpridzYwHYApNv9N71e2L6EAlD8Fj0KegXS3gHZmZ4169SMfBa6ECLjif9umuSCAYwY12pgxgS/8wdVpFiWFVtP8PWfjjYqeW5rm7n7lYicqQaG5RySOk9KbmTx5LF3rYNN7lSv71gKwh1XORRFh34Qw6HOO+WO3JJ5RMdarqhyMlcmSlINujx6EKDJHeGPaQ+XENmcxmM3V12r3qVVCRUgwpgUHucO6sHpfHPEaZt7DuzY+cXTgn8OK+Rg8YcE948t5OcOyRYcd1bJiRBx6QJ/U230jD8jdY6QJ848Q4myQRg==
x-ms-exchange-crosstenant-authas: Internal
x-ms-exchange-crosstenant-authsource: MN2PR17MB4031.namprd17.prod.outlook.com
x-ms-exchange-crosstenant-network-message-id: 68f24c4b-0baa-4c1a-e6da-08de899a4231
x-ms-exchange-crosstenant-originalarrivaltime: 24 Mar 2026 11:41:16.1518 (UTC)
x-ms-exchange-crosstenant-fromentityheader: Hosted
x-ms-exchange-crosstenant-id: 514876bd-5965-4b40-b0c8-e336cf72c743
x-ms-exchange-crosstenant-mailboxtype: HOSTED
x-ms-exchange-crosstenant-userprincipalname: Ce3mQM3W1zebJov6YdfNDqF4I68yn3u6NK/zRtz1VKKJGR/OAjQnlIZzuxvHDmxTQxiBEF26HZJHfj5Go4MYAA==
x-ms-exchange-transport-crosstenantheadersstamped: SJ0PR17MB4928
Content-Type: multipart/alternative; boundary="_000_MN2PR17MB4031ECBD55FF4F337BE3DD82CD48AMN2PR17MB4031namp_"
MIME-Version: 1.0
X-OriginatorOrg: akamai.com
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-24_02,2026-03-23_02,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 mlxlogscore=999 lowpriorityscore=0 bulkscore=0 suspectscore=0 mlxscore=0 malwarescore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2603050001 definitions=main-2603240092
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzI0MDA5MiBTYWx0ZWRfXyMdB30DiwXDh WylXjux+MTuup113frFaXXt68/CVK4CWqCnfsdP/He1MWPCHz3ZK9gfH0IBQPbgTHkLbYBN0s9p WSw/vhYvwAcmf/vy25dR2Ts1l58qvE8hBJ4ppCJ6al90uN0l61pvH0cy+Jzif34pgTrkEjDUhWH 7ida7idPjlSRCOBXQuimeSFKLPaIsoFIuAAHXuWdosPKnKjqwyAWZcz5V1XWRoubIlEMcYT/+TU biHxF6d6I6rAw8cxaYfCDDT2k2ieplg/bcwH9xRAJiCUagNDGPV36kcDHwlm7loEqjWTzYHURhh h98d+1b/RerO8LPjLBkU629mcDR017UmCbWcwC1+z3CbP+XUdxN5SktiMktG9NLrq6NS5f2134b QcnOST2hO3nEVpPuaWULLU5C6oAYcNbdaCUizV9FYlX19fQZ7njyFb8S4wt4pylWT+JTKpfT0Hx diByXl4PU0wk3DTq+yA==
X-Authority-Analysis: v=2.4 cv=b6GCJNGx c=1 sm=1 tr=0 ts=69c2785f cx=c_pps a=x6EWYSa6xQJ7sIVSrxzgOQ==:117 a=x6EWYSa6xQJ7sIVSrxzgOQ==:17 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Ifg-1AOnLHOf1gn6spyb:22 a=8P__5Em-pwOPtXrf4HJ0:22 a=fnYxPFhOecyge94KeSkA:9 a=CjuIK1q_8ugA:10 a=tqdMzFhGG8mD8GCBlf4leDhY3gs=:19 a=dj13lq5tjE_5FwBd:21 a=_W_S_7VecoQA:10
X-Proofpoint-GUID: aT7F9T37utPiK6UAJepwYnkDzcxQbNq6
X-Proofpoint-ORIG-GUID: aT7F9T37utPiK6UAJepwYnkDzcxQbNq6
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-24_02,2026-03-23_02,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 suspectscore=0 lowpriorityscore=0 impostorscore=0 adultscore=0 phishscore=0 clxscore=1011 bulkscore=0 spamscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603130000 definitions=main-2603240092
Message-ID-Hash: NWBUBJQ3LMMXX5H3OFHOSHIS32JKUF7J
X-Message-ID-Hash: NWBUBJQ3LMMXX5H3OFHOSHIS32JKUF7J
X-MailFrom: rsalz@akamai.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/WDOxxOJrXSlyR4ZttzXMbKCiTpE>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

 >

  *
What application domain are you considering using the client certs for?

Whatever they are currently being used for.  I would like to know what folks who are using WebPKI and client certs are going to do now that Google Chrome has effectively shut that off.


  *
I have been trying to work out ways to make client certs work in an open PKI and have come to the conclusion that PKIX is just not the tool for the job.

Okay, thanks.  Not an option here but good luck.

v2.46.0 | Report a Bug | By Email | System Status