[lamps] Re: [EXT] Re: [TLS] Re: Re: TLS Client Certificates; a survey

[刘鹏辉 <[e-mail]>]

I agree with this viewpoint, which feels a bit awkward. It doesn't necessarily require a domain name, and this protocol itself is not P2P, but a C/S protocol. If necessary, TLS client certificates can include notarized identity information or carry information for multi factor authentication.


BR,
Penghui liu.





在 2026-04-01 10:05:14，"Blumenthal, Uri - 0553 - MITLL" <[e-mail]> 写道：

First — it’s a question who hitchhiked on what, but I’ll leave it alone. Also, when I authenticate my browser’s TLS connection to an email server via PIV smartcard (seems to fit whatever you guys call “webPKI”?) — what EKU do you expect to see in my certificate? (Hopefully, not SAN with domain name? I assure you my identity does not include one! )


I don’t understand where you get the idea that CN/DN would get “only a domain name”. In your PKI — perhaps; definitely not in mine.
Regardless, unlike IPsec/IKE that that is described as a peer-to-peer protocol (Initiator and Responder — but not Client and Server), TLS has been defined as a Client-Server protocol. Thus, both ends presenting “TLSServerAuth” EKU appears weird.

--

V/R,

Uri Blumenthal                              Voice: [phone] 

Secure Resilient Systems and Technologies   Cell:  [phone]

MIT Lincoln Laboratory                     

244 Wood Street, Lexington, MA  02420-9108      

 

Web:     https://www.ll.mit.edu/biographies/uri-blumenthal

Root CA: https://www.ll.mit.edu/llrca2.pem

 

There are two ways to design a system. One is to make it so simple there are obviously no deficiencies.

The other is to make it so complex there are no obvious deficiencies.

                                                                                     -  C. A. R. Hoare

 

I was a shepherd to fools

Causelessly bold or afraid.

They would not abide by my rules.

Yet they escaped. For I stayed.

                                                  R. Kipling “Epitaphs of the War. Convoy Escort”

 

 

From: Seo Suchan <[e-mail]>
Date: Tuesday, March 31, 2026 at 21:24
To: Blumenthal, Uri - 0553 - MITLL <[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [lamps] Re: [EXT] Re: [TLS] Re: Re: TLS Client Certificates; a survey


This Message Is From an External Sender 
But this is about clientauth certificates that hitchhiked on WebPKI, so only CN/DN it will get is a domain name too.



On 2026년 4월 1일 오전 10시 1분 46초 GMT+09:00, "Blumenthal, Uri - 0553 - MITLL" <[e-mail]> 작성함:
Client cert (obviously) proves client identity. Depending on the use case (aka, what the client in question actually is), it could  - though typically unlikely - be SAN. But anybody sane would use CN/DN, which was what the certificates were supposed to authenticate. 


Example: I authenticate to a server via certificate on a smartcard. You don’t think that cert contains a server name, I hope? It contains my name, proving to the server that it’s the “possessor” of the token (issued to me) on the other end of this TLS connection. 


—
Regards,
Uri


Secure Resilient Systems and Technologies
MIT Lincoln Laboratory


On Mar 31, 2026, at 20:48, Seo Suchan <[e-mail]> wrote:



This Message Is From an External Sender
This message came from outside the Laboratory.
 

I kinda think from what certificates in mTLS try to proof, in most time if SAN is domain name Serverauth is more appropriate. aren't client try to proof it's server node XX and this is message for it's users behalf? I have hard time to understand what clientauth certificate for example.com would try to claim, public or not.

26. 4. 1. 09:25에 Blumenthal, Uri - 0553 - MITLL 이(가) 쓴 글:
I have no stake in this fight, as my CAs will do whatever’s appropriate for our use cases, regardless.


But for mTLS, when both client and server expect to authenticate each other via certificates — what KU/EKU is the client’s certificate supposed to have, to ensure it is allowed to authenticate a TLS client? And why the asymmetry (no pun intended) — server does provide a use-case-specific EKU, but a client doesn’t???

--

V/R,

Uri




From: David Adrian <[e-mail]>
Date: Tuesday, March 31, 2026 at 20:01
To: Mike Ounsworth <[e-mail]>
Cc: Nico Williams <[e-mail]>, David Benjamin <[e-mail]>, Salz, Rich <rsalz=[e-mail]>, Tls <[e-mail]>, [e-mail]<[e-mail]>
Subject: [EXT] [lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey


This Message Is From an External Sender
This message came from outside the Laboratory.
 
> > Does the IETF have a Liason to the Chrome Root Program?
> 
> + @David Benjamin and @David Adrian both participate in IETF.

Speaking for the Chrome Root Program [1], the policy does not introduce a blanket prohibition on all CAs from issuing TLS certificates containing both clientAuth and serverAuth EKUs. Rather, after March 15, 2027, the Chrome Root Store will, by default, only include anchors representing serverAuth-only hierarchies.

This does not preclude CAs from:
- Continuing to issue from hierarchies that may be trusted elsewhere
- Issuing clientAuth certificates from a new hierarchy

Nothing also stops non-Chrome clients from altering the content of their trust stores to trust CAs relevant to their use case.

History has taught us that commingling PKI use cases causes more harm than good. It is a consistent security problem when PKI hierarchies intended for public web sites get entangled in non-web use cases. As an example, such behavior slowed the deprecation of SHA-1 in 2018 because payment card terminal implementations and their corresponding root stores could not be updated.

The plan to move to serverAuth only was first communicated to CA Owners at a CABF meeting in 2021 [2]. It is designed to prevent more situations like the one above from happening in the future.

[1]: https://googlechrome.github.io/chromerootprogram/#introduction
[2]: https://drive.google.com/file/d/1pwhslUTqqkJci84nzyP4jUEmop4MeSVP/view


On Mon, Mar 30, 2026 at 4:53 PM Mike Ounsworth <[e-mail]> wrote:
> Does the IETF have a Liason to the Chrome Root Program?


+ @David Benjamin and @David Adrian both participate in IETF.


On Mon, 30 Mar 2026 at 15:40, Nico Williams <[e-mail]> wrote:
On Mon, Mar 30, 2026 at 08:04:54PM +0000, Salz, Rich wrote:
> The overwhelming response (strong consensus) — both posted and via
> private replies — is that applications will just switch to
> TLS-Server-Auth identities for the client side.

That violates RFCs 5280 & 8446 and vitiates the Chrome Root Program's
new policy.  Whatever problem that policy change meant to addres might
only be made worse by this approach (sure, only for those apps that
implement this workaround, but for those, yes, it will be worse).

There has to be a better way.

Does the IETF have a Liason to the Chrome Root Program?  Can we reach
out to them and ask them?  When I did they simply did not respond, but
if the IETF TLS and/or LAMPS WG chairs, or IETF Security ADs reach out
to them perhaps they'll respond -- failing that then maybe the IETF
Chair or the IAB.

Nico
--

_______________________________________________
Spasm mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
_______________________________________________
TLS mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]


_______________________________________________
Spasm mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]
_______________________________________________
Spasm mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]