IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 24 March 2026 07:57 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 12A73D0845DB for <spasm@mail2.ietf.org>; Tue, 24 Mar 2026 00:57:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h_NzyPtBIMbB for <spasm@mail2.ietf.org>; Tue, 24 Mar 2026 00:56:59 -0700 (PDT)
Received: from SY8PR01CU002.outbound.protection.outlook.com (mail-australiaeastazon11020113.outbound.protection.outlook.com [52.101.150.113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 966A1D0845D6 for <spasm@ietf.org>; Tue, 24 Mar 2026 00:56:59 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Ziy7LVfxMj/ds3F4xFjOBR6eyM4ZVUfV0qCmxzWu9dISB2oiKV3rNT+zdrDMUc7DP5nkVKnKXGYv2Kq8ZbH8U2HZdD8H3EZ5yT97kjacDzabgrJDhEv9oO+vRj6E+X53m0lmZ1nlxbx/XBS+tI7C7NFGet3mFOeFqHVlS/0HZmq1OCXPjDWvrdN7N83V8Xb+OKHrjyDTnvmkWrmgxmAn3UoU7j6raeswsHnXcMlLM/kX7ZlejE2UQY6uAsf3eUw31yG6Gu29YHlwxF1se13aQRsdrNGKuO+S7SzN5gZsORfDoU+PeJ9MjQkCx0fy2yQaAPeqRFoU/dytFlmuxJmwyw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=rCcoHLES/XUSIbhshvdiZBAT+aoKXGUaQKeq5JqqrPc=; b=Av0hlP9BoBtLc6Fh50oKl/T8r4pM3AP9QrAlDRWJV6dgoPxltjoUhn9DxoLdk0bVthIz49e5SgS1iMIiFjFyZQv6lL6HGuhbH8eELmCLpupWHAu1q+GrM3hwKoPrfnKovXMCNo03rlFjA3f2NnxR5cfQFH7wOd6Z2+ZTNFQaio2nj74mQU/E9ywRSMJlMajc5WIc2HOtaDU+tXzKomW/96Q8AEO+ta6HBfWgyDQaMIvVTqgUq/MonHHxTvalZQPnchB3u+yWO7RBokEznFKQYdPwtLE2rEqqTzu2IYDmLSiW87sSY6woG+w/GLsBbzZJvLWeoaNas9Yhp9YF/YVSfw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rCcoHLES/XUSIbhshvdiZBAT+aoKXGUaQKeq5JqqrPc=; b=MrUZn9tiDsQV7Hskf01xWfmcu61HGlN4hWG+IdwEdz3MM9hpaogknAuMNLGuqyoSAFlxZxGix91VAck52EwKXpjzl5JoRM7Ja/m50Mbu5FnyHfMyDneTCAYIonvWLZKEdWZ/Yr9kvXWsOxFejJcWoRO79aKaFVja5XOn6ZBA+MRLALzxPe1VNusROsSM/Qi2m4n9pAiF9AAcIpIX1D+RIs1LaDYZyu0KJ22QIIZuOnO4cop9mwJMmZ7YgT1ZOskK9XayG4i+1P4g1Ev245kSbHeIeu0Ay9CXJjkEXXd7f/wXaEtciJkl2kZeBokoF+nONU50iSXBqt+yf6VjqqR3tw==
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com (2603:10c6:201:38::9) by MEYPR01MB6631.ausprd01.prod.outlook.com (2603:10c6:220:12a::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Tue, 24 Mar 2026 07:56:49 +0000
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064]) by MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064%6]) with mapi id 15.20.9723.022; Tue, 24 Mar 2026 07:56:49 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Alan DeKok <alan.dekok=40inkbridge.io@dmarc.ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
Thread-Topic: [lamps] Re: TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7W8QaSAgAAI8YCAAATMgIAAD2KAgAAF6ICAAAnzAIAA50IN
Date: Tue, 24 Mar 2026 07:56:49 +0000
Message-ID: <MEAPR01MB36545ED59E2D8870377B8268EE48A@MEAPR01MB3654.ausprd01.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <acFbuTA8Wm20nQ2s@chardros.imrryr.org> <acFjOWV5IlrT1Ytx@ubby> <acFnP10qMoESdD30@chardros.imrryr.org> <acF0J/bL6yrm24Ty@ubby> <acF5GwlXNLo8iJB4@chardros.imrryr.org> <008AF02A-656E-4B76-8C48-85D1B0735AFB@inkbridge.io>
In-Reply-To: <008AF02A-656E-4B76-8C48-85D1B0735AFB@inkbridge.io>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MEAPR01MB3654:EE_|MEYPR01MB6631:EE_
x-ms-office365-filtering-correlation-id: 842c3090-10ad-4bd7-ee82-08de897ae758
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|10070799003|786006|366016|38070700021|56012099003|18002099003|22082099003;
x-microsoft-antispam-message-info: cd4K/kyvp490v7wN2nI7yM65SeuxHopE8nQ39sUXja4hH/TYiYZzMPUNwf8d2UFXPFh57ne+slycLqimKkNprTbOy+RTAZWTnsneL0Q3SaFvYJO8/FcNJDYYd1WCFB/cVvxu7vmP7f4+pgODIGMJAoBAD6SlwGsYwTVuyeIfUqmyKVEUP73jATF5PEjiS/pPQQBTdJXJZj0JSBJHnqx6bjZ4KCNYG7ewoItRwBEuKaC8JtweXfuPCClQfLahtO2tFWzcaPu8TH9krufRTne+0TMLDqOAcvD0kzxu99Ajb4qqVI2WEtaUcj1Zk5mURnbOT/0/XWT33zJZFNjkrQWDklQJ53iOdAoL8NW0fq3CCrOg1zOgkPaMcLjfTQm3M8CDPspyhzT/yme+ik3z7pwF9cGBxQGJyVbi12BR0DL2p0WhPRwLMVcuYXXJ2mNgBU2QJwRZoO9v6fs1zhjlUyXVibAT//PwZbIrqCOtRVZWH48lD/EcYnf9Tu2O9z+JcBn+6wijQ5SEdjr1smRtFvGSAa9uPuAjZ445qezgPbevLDVSqNceoYaMcBYH1BnPk+9TI9wTcak6ce6bqGI7hbWv5FIJWseExaw+qDrM0+B+zRtrPzygDWmUoQCz+XI1jPtjlBmdldYYgkNfjDTUA9o/oO7PkWgxSQXQJzaynDpkZCqmp9fL+SxGzx2PLo+RQ1B/vddUyVghPVUFiZwZN8k/Jp7QYzCaB5iuwSC5j6Qyx1adj0rjYFxWv44aRsRjyMWgt6qsFDShWaRxnVt+iYwPgUA8/jOztuDUShV4aR5DX2M=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MEAPR01MB3654.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(10070799003)(786006)(366016)(38070700021)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: klqET3cZ35wqYURYhpVOySO86bop08AToz/3nty0a5/XORRwXIJU1DKuC4uFDK44kfj+NDMuY11EOUN0CAgOnOiEkR3/9GPjUf5jztSyXvRsXEW3OimL8tAv4CKDa5bzoejpbXcVCoWdeKizo6Zw9b6rPoR4NSCneejeZR2Yrtx/7cKjZbm2Xses3zhsM+ZERGpDkkEYPtN3ey5PVNu3NBu+tLYQCppOXUqJTNVbObADmqb52gcXx/TC9DTn8m5I1fe9bLqZyrrDOQuhQZfg+YFpwTqHBlczGyOKoODifxyE7Y8gqEw3l6zfWRx+guL/ztIlP7OJumHGl2Gwp3hnikuqiOKuAYk9cRgURmYLNfEDZe7sChGMSRExwFMjezdvxnhXTTDE2LrRKefcYtinXiuEWvkI+yC5phs1C+uPsn5GskN/KasElwE3sbRmMGw3nmjcBB0up2BalAf6cjQU7RBRIGZSd3xB8bmDdXysNr5SYGywut8OtnZ3Y8IIeo8XCyIAV91LqPoKmae8js4tEwBNPZeVSbHuQIBWiR1Tstow9FJoEq/nUkF271sWOJstNxPeEbrwWOnu6ZBaedW1qWaRLYyl2OSEuHIw3J70zS1D57KGc3Ot+6rkWMRAa4RY/VHc4HVZq0Ez1yaSd9E/3aEDdi5RQI8a8LkE8ZZ7ZRYU33bq2ujXLCveDIN9zH2XB80pGnD9xsrAdGlzJrefaA43uU4KS7BOjgICskvuUqL1qRQQvWuJbQdHQzJtDLNUOOAQArOWvGfYkdASx9Suk52ZNtgzs5w0N8VKIxCXRMunSy+f0pWkPUg6t5ERbEKHjyYF/1w2cVIvt/CNwCfn0mYqvp8AbAAbllCrj6wTH0yY8SFAFXqcL0qYN67XzKwy5nsVkCt2pZrSAOBLksS2+bPY4mX6q83TXpK2YxAFNfxJEBUcj/k2Yu6TPsTXISA5RUJTw6x03Ye/MtgV0H+YDBaU/UxWo7PdewvDjyLsIMDQb45xO6AA8J7HEFi2SRUrshRlMSfpMHQsihKPXbJddSR3drK90LUQ9wH6ejERXLV4YfcRauIXDagWTl5+Vwd4APcWKNB8pyksCQJ/QOdoKqGRDAFgNOWGSDXUidRtPTxD5m6n3dOXBoSIajCvSnYVqgt435nHYC9VAX3BWpbwgZIqZ+TODfnEuHow+UgPIcPkNqb3RmicgX8nS0hxuKYQf/GZva6G+HJt+yoAO30Iyfzo1XLaMwLBE85pz2wYr3o6Gng86fv+BJLj1AmYgnrJ7UgagJg2Z6I1Mfp0ViHg29IRYyB05Pbhnp1qr+O9yqJ8nuLA/AQI/CIchzl8rtEzMmKp10dTCkVJlYje5FZIaGk/Ni/8/tAIz1pdYzjD91Z1UOHivaMGDy9oy/1nW7LVGp1WFr7hWu/rnqFU8uXxnNdLsNBclItcObG6HDF7c8U9vN312M/NX7R6WXUibgs4A9R2E5XGIR+r0sRsR2RZb9vWU74Yo9NZHe+i+rbGvT/eiuQe30lWelEy7EBY3+iBoBRa0mzqyNJPo0syuNi4vaLH58TU1hNSQhOgpReP/EedaAavZliqCdPdUJNNd+3WzR7P1ksh8ps4Pb5WUcUIURgkZ+jqspKNE9Kt6S+y5SKpJ7h9SS7NccDTERyKSERKQd1F8UXMY2OEjaonhdEhzA2+dj7WLzZb/eB6pyi8+W42voGjJuR9z/1hWhOIOo2dcnLR5zIuAe/fxypLRYdzrcqcwI21Al403t90ufW72X/g3U1ywdThku+6UmFIkN63H1VSUcUW
x-ms-exchange-antispam-messagedata-1: E+E6SdMyyR/ziQ==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MEAPR01MB3654.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 842c3090-10ad-4bd7-ee82-08de897ae758
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2026 07:56:49.3258 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: l/MAUC6R/+1rIr6I7Z++D2wEzosuez4S/Rj8a3jSgqFvExR3Ef+stTSiBvFein04M/yrt6TYCgi7YZK23lu/StJA7szhvCPWu4J/VgD4RaA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEYPR01MB6631
Message-ID-Hash: FOR756KYEIRL67Y3V4O6Q5VMDGCYVPM7
X-Message-ID-Hash: FOR756KYEIRL67Y3V4O6Q5VMDGCYVPM7
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/atRqs8KSYk1adHy6wq4qo4VoOZc>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Alan DeKok <alan.dekok=40inkbridge.io@dmarc.ietf.org> writes:

>That the certificates need to encode more than 1 bit of information about
>permitted use-cases.

This issue goes back more than 30 years to Blake Ramsdell's
bCanUseTheDamnThing model for certificates, they're a massively complex way to
encode a key and a bCanUseTheDamnThing flag.  This came about from observing
that users couldn't care less about policies, name constraints, policy-
mapping-inhibit, initial-policy-set, notValidBefore, and the 1,001 other
things the standards groups have dreamed up over the years to make life
difficult, but only had one concern when it came to certs:
bCanUseTheDamnThing.  So for 99% of users out there a certificate is
just a signed boolean value 'true'.

Peter.

v2.46.0 | Report a Bug | By Email | System Status