IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Alan DeKok <alan.dekok@inkbridge.io> Mon, 23 March 2026 19:01 UTC

Return-Path: <alan.dekok@inkbridge.io>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1F036D024DEE; Mon, 23 Mar 2026 12:01:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=inkbridge.io header.b="DoAPw9w9"; dkim=pass (2048-bit key) header.d=inkbridge.io header.b="OZ8VTbUk"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D_jH8n7ZMNLU; Mon, 23 Mar 2026 12:01:09 -0700 (PDT)
Received: from mail2.networkradius.com (mail2.networkradius.com [184.95.211.25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 8ADF3D024D67; Mon, 23 Mar 2026 12:01:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=inkbridge.io; s=sep2024; h=To:References:Message-Id:Cc:Date:In-Reply-To: From:Subject:Mime-Version:Content-Type:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=z3noTqRgDoil3BEo1Oc6huZr8ORNYJkkCjFrmzLfDW4=; b=DoAPw9w9lyfU8fXHf9GuKnkFro rAsliy62cmEEx7EGKDY3rcLhMe5bgNbgz6+49KEihp8b1rYwQHQWDcJ+MwOhDD/rDaGYextL9RpCa LpsP/LP+HRfE9Nngcx+qBupinbqdEem4Eu3hHoeLGTVJ/Rc+Wobl3aM+h0wNZicgu7IosjDMRZTAo MLlFXe4Xghz7S+HVHy/6glw3O7P0NL9VCWVgv/gtocK4Ps2e/Wnv16TeIDEbXloTlntsUQcZCQqfQ nY6jut0hrpXyG21FoML2Ay2jG6bsHTRotHQkkBKvq9thIixLlWDivVvMe6U741uuEc4dj6rR4dMui AcGMO8EA==;
Received: from mail.servers.fr.internal.networkradius.com ([192.168.42.56]:41958 helo=mail.networkradius.com) by mail2.networkradius.com with esmtp (Exim 4.97) (envelope-from <alan.dekok@inkbridge.io>) id 1w4kWQ-00000001DpK-2Gj9; Mon, 23 Mar 2026 19:01:06 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inkbridge.io; s=sep2024; t=1774292466; bh=z3noTqRgDoil3BEo1Oc6huZr8ORNYJkkCjFrmzLfDW4=; h=Subject:From:In-Reply-To:Date:Cc:References:To:From; b=OZ8VTbUkD1qJU0o7lrM/qVFJt7hMWIrPgHBL8wsB7w33uzjRZ0QYjgE9NWVVbdDZb HBV3PSm03pki34pQ+8adflqIWbVrZnDoHvUIPsGRQcnEvlqdGmQSQXhOMQqw2OcjyI gvxcyiRf9V4NTtZH9aDsz/g8qndxJWIne1s5huhso6HSJcZSnBes54DzZiwHKRoJXP 35ZzZBuK4VprgHVJCU6Bcg1AdAycgU6qsP3jrLvBbkDLBws/9Eiv3F5bFqQtVZ5Dh0 P7QkHvsh6ar7LRJ9T3m/dkGcmdVxZe7GOlY8V4gdhP4s2drUVqi+xV+21faCq074Fq ctFMl0hiorSkw==
Received: from smtpclient.apple (unknown [27.252.232.19]) by mail.networkradius.com (Postfix) with ESMTPSA id E7B911EA; Mon, 23 Mar 2026 19:01:03 +0000 (UTC)
Content-Type: multipart/signed; boundary="Apple-Mail=_C680B158-D106-44CE-A815-20EFB1F4FE42"; protocol="application/pgp-signature"; micalg="pgp-sha256"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3826.700.81.1.4\))
From: Alan DeKok <alan.dekok@inkbridge.io>
In-Reply-To: <DU0PR03MB86960694D96A2E52CCED6440864BA@DU0PR03MB8696.eurprd03.prod.outlook.com>
Date: Tue, 24 Mar 2026 08:00:48 +1300
Message-Id: <6952177E-8DC0-486E-980E-67CD5A0E1569@inkbridge.io>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <4732.1774288835@obiwan.sandelman.ca> <acGB3/g8HMNNOP4J@ubby> <DU0PR03MB86960694D96A2E52CCED6440864BA@DU0PR03MB8696.eurprd03.prod.outlook.com>
To: Tomas Gustavsson <Tomas.Gustavsson@keyfactor.com>
X-Mailer: Apple Mail (2.3826.700.81.1.4)
Message-ID-Hash: PBCK3J7TL5QFSBYUZD7XIFIADMIQ2QJ7
X-Message-ID-Hash: PBCK3J7TL5QFSBYUZD7XIFIADMIQ2QJ7
X-MailFrom: alan.dekok@inkbridge.io
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Nico Williams <nico@cryptonector.com>, Michael Richardson <mcr+ietf@sandelman.ca>, "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/b2J8Y1gSRuEOOXcp32fQivwaTT0>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Mar 24, 2026, at 7:21 AM, Tomas Gustavsson <Tomas.Gustavsson@keyfactor.com> wrote:
> > We should admit that the CA infrastructure has failed us for nearly all use-cases.  Either the CA infrastructure is the web, and (despite the CA/B forum
> > rules) it's OK to use web certs in non-web contexts.  Or, the CA infrastructure is more than the web, and we need to have new,, non-web CAs with rules
> > outside of the CA/B forum.
> 
> There are tons of CAs outside of the WebPKI/CA/B Forum ecosystem.

  Where can I get a certificate for mail.example.com <http://mail.example.com/> that is (a) trusted by end-user systems, and (b) is limited to id-kp-This-Is-A-Mail-Server?

  What happens now is one of 3 things:

1) use a web cert, and lie to the CA/B forum about what you're using it for.  This (allegedly) means that they can revoke it at any point for mis-use

2) use a private CA, and have everyone else on the Internet refuse to talk to you, as your CA is unknown

3) don't use TLS.

  Alan DeKok.

v2.46.0 | Report a Bug | By Email | System Status