IETF Logo Mail Archive

[lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey

Nico Williams <nico@cryptonector.com> Wed, 01 April 2026 17:14 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 63BE8D4F2721; Wed, 1 Apr 2026 10:14:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775063673; bh=nT+qmxar5I9QiRp4zQI+vzpdvNouHyZ4XBbdPzxhrz4=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=C0sLMfyRZyyOEd44l7iq+HQcJ9OCGx2+CIRULm2p4/+rrj/fa6stz0HOzBcsKU9pj 5e2hbLkwYo9v6kEPRFk7pHuFvIcX9YTFDQcIauN8fCB6KeJB00cdZBM9mpFzC9Utsf m9GYdByxECLIRLaRqsitGVtK9wzGsLGxuLrGAhsc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AMBnh5fD9clu; Wed, 1 Apr 2026 10:14:31 -0700 (PDT)
Received: from elephant.apple.relay.mailchannels.net (elephant.apple.relay.mailchannels.net [23.83.208.57]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id D8F1ED4F25F9; Wed, 1 Apr 2026 10:13:51 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 008787E2A36; Wed, 01 Apr 2026 17:13:45 +0000 (UTC)
Received: from pdx1-sub0-mail-a222.dreamhost.com (trex-green-7.trex.outbound.svc.cluster.local [100.96.162.196]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 4221F7E0E8F; Wed, 01 Apr 2026 17:13:44 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1775063624; b=8wtHH2T1sYYgi0hXbGh11euFTW4BNYLVOYwiwg1and+p72dRGYFk0TfT3tBOn5ySt9vhRS XVKWnZ16e4n0S1+jDK12tb3dyEuWkahlmAAGJxzjF3p7mldHbtZUjFKfZc9VKP8kqf/oIh vIEhc/w/FBZG/uglbRByuZU8+r4E737Qz/lyIJIQ6Ivycjhm4TnNnf/XVzedlge0NKhxR/ YsIQbcQTj4A7ww9PzWyITDJSCdsLmiF3nAuxgPN1ixafyHBkLknuXFZ582vK2F2cxTMKgN Q3n2HFHozLevAOmtYpnT/eiFsA/xBIYeyXuOoea3ZGXMXSlL4l+c/cFAzQ+3gA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1775063624; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=OV+FX2A6sY7XCxnGFyB+I33O/uUkQsTYVf/Clix7tGQ=; b=xyd4B9dlZPxEFdXfN00mwyzyqB7kgK2pmXR2OqhYgGNmPs60Yrv18npWBD6etz4E7hvspJ ZwcUEs+Zbv5g0StPr7QM4o/0PdsgB5uuj7ZxNpQUinXJeEa7YMUTA0l2w5z7bgmihLrdXf GQmu+IFi8g6EPv/khtX2MlK5oAZ1MvaPn7h3QtdkjBKppqNoEfZYRm/hqPYD9BGwtY4UIH Dv8qejsARh2mWMEDBApkgP07cAr2f5+eHIgOjFneoUF3RO9iYuycZeqa4dE3e2jpnmjr3u Lk6mZAFOpFEXsRZ4XRbLitymd0ue5hbEdBcskmh5FLsFOD17oA2EIeO0x1azGA==
ARC-Authentication-Results: i=1; rspamd-bd48b9d95-v6vvn; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Good
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Whispering-Befitting: 333303404e040b95_1775063624866_1417063902
X-MC-Loop-Signature: 1775063624866:210463251
X-MC-Ingress-Time: 1775063624865
Received: from pdx1-sub0-mail-a222.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.96.162.196 (trex/7.1.5); Wed, 01 Apr 2026 17:13:44 +0000
Received: from ubby (unknown [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a222.dreamhost.com (Postfix) with ESMTPSA id 4fmBQv3HyJzRL; Wed, 1 Apr 2026 10:13:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1775063624; bh=OV+FX2A6sY7XCxnGFyB+I33O/uUkQsTYVf/Clix7tGQ=; h=Date:From:To:Cc:Subject:Content-Type; b=Fp4hVhqX7DqNf3RPlNYvi3p18fJWyMimIZxMAE9o8qWhshzUVoC/YaLIAPdwDW7PT JZGlVVZXtZrlURjFCE8iC/WSs9JyRYhSWwfNmZdhXPacYsCmqICD2SMU5qgUSq5pQV Y6fyS+WDqRepziJuIBMZZwrL7wQgB4UdY9Mq2I1D/k4RBx4ijus6DL2wPKhmQ1H3Iq oX8b7gPdiEfFHh6hkdA48RoHqY5McmMCCM73qcVm39fyDmy8lnGzSUzfx6TuZutJoy VfSuKtKwRcGCH+mCowyDhps7PB351kUEZMZbozPV/WTWUburcfFT99ljjt6dQQ/umn LDbxilWowIhZQ==
Date: Wed, 01 Apr 2026 12:13:41 -0500
From: Nico Williams <nico@cryptonector.com>
To: Rob Sayre <sayrer@gmail.com>
Message-ID: <ac1SRTjApUr37jSV@ubby>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <ac000NJH3A1MaZR/@ubby> <CADQzZqsT0qrCyusarQY1AK6w4M8jSbA8V-f+va7U-tv+KMUd1Q@mail.gmail.com> <CAChr6SwSSwsaUHBCVUZ=Srzeg9FQFS-DWM-6V3j3XycmEwcyUw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CAChr6SwSSwsaUHBCVUZ=Srzeg9FQFS-DWM-6V3j3XycmEwcyUw@mail.gmail.com>
Message-ID-Hash: Z42GT4HXNZEGXLTI34ZDQEDVH3GT6BQM
X-Message-ID-Hash: Z42GT4HXNZEGXLTI34ZDQEDVH3GT6BQM
X-MailFrom: nico@cryptonector.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Mike Shaver <mike.shaver@gmail.com>, "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/Y6s7MlRv-xsV5H9MOUtRbMhIlQM>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Wed, Apr 01, 2026 at 09:31:28AM -0700, Rob Sayre wrote:
> Impeccable timing. Let's consult RFC 8962.
> 
> https://www.rfc-editor.org/rfc/rfc8962.html

That's disingeneous.  I am not proposing that we have a protocol police.
I'm proposing that when one player uses their market share to force an
unwritten change to our RFCs on implementors without any public
discussion, then we ought to use what leverage we have (e.g., a
statement by the IAB) to object.

Nico
--

v2.46.0 | Report a Bug | By Email | System Status