IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 24 March 2026 07:50 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 38A32D0829D8; Tue, 24 Mar 2026 00:50:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MlftbJQt85QB; Tue, 24 Mar 2026 00:50:52 -0700 (PDT)
Received: from SY5PR01CU010.outbound.protection.outlook.com (mail-australiaeastazon11022119.outbound.protection.outlook.com [40.107.40.119]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E55ABD082643; Tue, 24 Mar 2026 00:50:36 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=eBhmgG1fnBbh5QfwM/ocuZjb0llBiQqCuYAU6fauz4NTvpRBsZTcgfUJ6JCqEXJ7TY6w82CAPV7eYkHQrmcPACvLHYzVKXMUSMcgoB9M6WETZvqxMVCxl48at1HTRgo6qojXob1SrtXU9fKIIuJfWGLtSYye7Ndtokn6aWV16PgmjxOj64BVKRmj4I3l3f/GMY9KGqgPExN+M5/IyKO/qeFFCOBEpVRQTY4SGiuUhKP0NVWspFrmUrWuIZCeh/4kf+W8cAmMifwI5QQY1Ai2Seg/4vVcDQxyQcMHI5l4WLh0d+B2FY4xyqzKC1lJ66mj5EJtiqvWTyZVq5bFEtjV+A==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=KREFJE55fJuRP45O0UH00Yuu/X9YMDNJgW35P53Naf4=; b=wmz38OHQe1SRY2xqNNgKzDqJaARI3/jJKKeW45qnXmJAZ4pKl6biU4R6RrMo6Yt3ZjSF3KiuaAW0ajMge3NXmIp5oryW/iM9i/1/gWTtp6XSHFUv9I/ED0qh5kEA3bxfB0RR+JhYMlKPCaiqE0XjbBU9cfQ1alMxDu2jOUmb7Iq7P0CIDsyUXJabGLHLgBxbSBPZjbGWzL0tCti1lwMQHt1KqEErOgZpfcL89RrhqycscCoWL3myc8w2kI5QzXhhQYEt5zk79PzyQPv0JHkLurqeeLi1DVR8RIGBRv4bN1FWjG3iWB2xpVi3EA0ggONEsrfPIq3WUifp+WpuCofeOA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=KREFJE55fJuRP45O0UH00Yuu/X9YMDNJgW35P53Naf4=; b=Jq+Qg9ogGPL+m2qxQLMPhzK10u6fBG3aiOtgRlK4Hs1G7FMU0HbWyZXg+LJhFykQMFGKz55/e/1+M+f+4S2MMDxXyjoFjdnMDNFq2DQdsUSqdVpZVtSnDr+iVyHpy8viLQAtOT9J4tG1BtMuquab9J7EKkOhy+TnLZrZrd1p5wPVKc6s+V4VcBDkKFVQDyitpmLXRJF2+guT3OHlw5VlSOl+GW/stYtXzXLvlU7wkX7Ex9hW5ZasHPvBkl3uhSRHnEg1j/1evJP/lp6LF3fv/93bU6pPV8DPIigr1GfVwtu623Im9N6vuQvkpmQ39oSCC5ZT9m3kNRlfGVlbP1P/Wg==
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com (2603:10c6:201:38::9) by MEYPR01MB6631.ausprd01.prod.outlook.com (2603:10c6:220:12a::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Tue, 24 Mar 2026 07:50:24 +0000
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064]) by MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064%6]) with mapi id 15.20.9723.022; Tue, 24 Mar 2026 07:50:24 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
Thread-Topic: TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7W9U/sL
Date: Tue, 24 Mar 2026 07:50:24 +0000
Message-ID: <MEAPR01MB3654202C8134AC3523991A7AEE48A@MEAPR01MB3654.ausprd01.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
In-Reply-To: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MEAPR01MB3654:EE_|MEYPR01MB6631:EE_
x-ms-office365-filtering-correlation-id: 02b29bf7-ed60-42a5-263e-08de897a01d5
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|10070799003|786006|366016|38070700021|56012099003|18002099003|22082099003;
x-microsoft-antispam-message-info: 71D0AoqeHvcpyKWB7e8gmcJgm1tdnTqr1KFvBdD4b/dV7o4XdfGMG+314uL179kPMrhsBIUpx8SCNoxF7ZrIM8pB3mB8Ph3e8j3KHJYoWeXDb84P9a+WjSIDjQOuu6ICNTCn/5bJMZ071EAXHg99R5C/qIlqdevNbaE0Cu9pb8beSRD18VHmW/he8mA1UmFXIfKoPykap1DstCUW80ipb5AVn4yXKCI5AfnJNkmFbYNlYYDr2Y9o9EJYD02OO40U8nrSu8IFKxSteKz+981xhkcsJ7XLjMk29GHU6lNUDXo/7hcb2cImN6eBm1Mb+eezCvyUDCXSabB73sGcudvKWNmfKNuJ3fiKe1WzI7pXnP2RR+0E9KjD7MnnLfkFi9O62fIU5e/pm/frnsNex3e3QVF3OaifSzXAoLR6SpTfs1eV6cI+JZFOfAc+NOW1N4RkQrStmiIcN73rXYG6SbX3/cltJlFSPvyM5+gjd7QiMEMTajpmzRdngfCbZpwGY+8Hs4wR3ivXOr6zWRktm15y9K0qZEOzP7a/0c1EC6L7jt0Zcg6Qo2bsQh46pDDk7IC5vEsNcidH50ob0faGifeHjyk+VRLELq6ngRavdOgUbCQZ9UYmU/5agH0sYhXsdMr9l9TKfsqnEJxU+iJxKmBa9SDBXuPdrMNsljtXt6oDycUEKlHsQZ4Q9ByAOfMmr550FTOb7mEVdGNV5abH2cx6eY1AyUD/2iJdLmQpx8s0Bin8kpr48bHlMILKNaGw/s1yRj34YrkZ8r97bOrLI/5ytBkEEgO2TX1K3uUJXIMNeRc=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MEAPR01MB3654.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(10070799003)(786006)(366016)(38070700021)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: getJ1s0OISem08J/ZG1hP/khv6fIjGdtnbuzaFr1T/2wqWc5tE1fRwZmhyj1Zdo+WRPAZVyA++qq0a6V74f5DY8ZuxeumYAIdKpieEu2d75N77q4QE7asVE14muc9txDuEuyE8qEfyobuhyOpF+TlHaYiyFU7aAxAnpSIMXTFFJI67aw+h9V8zmnFsYu/VqgPbaYzyYsxUBw0Ubx3f2+lENkvHUKiyTEhX522DfKamEoLdcrdT+TQZ/12OuZt/yi2FwU9fiFhIA7w6YcsIGOOSdHkjF9zQzR2dlYB/WoqR202WfkZCQPjMDf44S4TZN7g6vKQroub/byRwXCypz9S1MCfUh2xAGLI3cjeoL/W24watDXawyDzOadjQEkJPplJi1o6GUbJeOZg4MziQ6LpQlCSfG2Hdx97KTNCg4vkwzqLuBQ4Tan6xNbylmB1OwKTExGRA8L79yl7aJ+K5nPvZFVSOheAdTDJEbN0I51BV7zvTgiJ/d7ZrZUgHo2H70yYkzmXhDdwIVM8pR7qbIqnZOU9ghWrzAIjQa0meHaTav+uBcYXAf8qt0ZY2EnIpRri4sgLKryAVFRj/zodFuiMrUOUTnOTlEEmrk5I2/rZyZ5dSwMAmK3T6HullulFNqoyH0m0kIBftYYiVEusUg5bPhGOo1HYTQg8vky1YHqhO4rqV2fd56XdtLPc8SvOKAcMQ+Z0ke20uiKW8/9KBeRLD13/XsnyrnFh9spKwMnsnS53l3Yhx+fjKFZKrQf3BVFeIAHzF/052reqT9hPHyY333CynwSU7aB6Z1ogZlv0px7VNHaBdRY1xHANRE7uiYM5TuXLc+WnsB9WShRlmTeCIj1JJf1Zr0/YxcVITWeK5eCNo9/Ru0tpyy2GCQxyHTl2k5I4M54vMxYjGCYbP2FQYXc67WmPpV9EDHd/bTqKhNzFBhgq/NzIRE91ZueR+/jZAE8XvIaGL+RDGWMcQqz1NDHKDShgudfh7+K34wVF1whjGuH4uP5ZoCfdueYlFAkewUZETLnqX+hFo2+TR4TreEugbpY00R9wTcn45tLudrFhYXyMNSDdBFzJHnNNw4Xv5pl+ntxcLsYsoeJi7fcgLle0jx3QQFiO3hVEYotGFOEviiS++ju2zE+W/TJpvXabuTqCoxdBKM2OthYCSVPY42gi0Fa1STBmS6lAA7awLXLxwG7QTrIaeXU+wTllsoe1bMe6ROR+0Tg6CMM/lRSCUqVdHQFgoCHJTPeelX++ocHxoJe/po2myNtW1u012iZcMa+uMCYrc38gfVMay3FEZ5crErFn8Zvev/OEpbXuaJ+TM5XaoneUKX7IsNa4+6EiCYBg40LYELhQurGNtBqWj6l4TN6IAd4ndwMZrYpFGqy+XmJ7TaNwGXc+eMO0OOwX/bqBV0v+RSQBijDG6D44Kj5hqDUojcYooFzz2RsSQr6p4HkWiD7KbJtDS8drMkUUxt9dljlXIahKf8mNBNp1QPuhc3OaRWOCpHx26sBmLuiCdkZ0VvKan7D7eqASgzgR2IAT5sENK4nk/q/4ZCmazkIIZVuBjcP3crv0E7o8MGE/6Of8f8FpoPlWxUbQYbSYkUisZRpP5mHgbpi977uv0tcyxl1oeWcricj2BqkaPfymfYd1vHfV2T85Tj2bH/XWmljBnOL9U6yfglXzg+LrBJXLwREEUbjIXtYdZwmh+5rGwMcSVWir2qXTZfQ3/o/vq9z5pIXV4Ipd77Y3pCCRlvB9//xgYMemIkjH7i1MJRIQQs5q3LCVndd+v1D0qJ/N0J7z9ON
x-ms-exchange-antispam-messagedata-1: QBYnfP7pf0PiKw==
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MEAPR01MB3654.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 02b29bf7-ed60-42a5-263e-08de897a01d5
X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2026 07:50:24.2707 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: brfQodTXngXjuyuH5jCkHzusweON1EGs9eOcRHFi8gvMKLa8R2Tw4MA7ZXd0J51+Zk11NtxSXga69nWkW3WwddHEoH6+7igV2Yd7qYo1uYM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MEYPR01MB6631
Message-ID-Hash: VAHHLIEEHPUQQ45RJQAYN2GAYYY3AR64
X-Message-ID-Hash: VAHHLIEEHPUQQ45RJQAYN2GAYYY3AR64
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/dBmV5bAW1xW6yTT__IK08CwAFUU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org> writes:

>Since WebPKI CA’s will not be able to issue TLS-Client certificates, what are
>the customers and CAs thinking of doing?

Same as they've always done, which for the vast majority of all TLS users will
be not bother with client certs.  For the rest, typically siloed deployments
using private-label CAs and/or ignoring eKU.

And commenting on another part of the discussion about what is PKI: Non-web
PKI isn't really PKI as such, specifically the I part, but a ticket-clipping
service, you need to have a ticket visible on your dashboard that's been
clipped by one of the Approved Authorities in order to participate in the
system.  Which may sound bad but actually isn't, it's a pretty effective
access control mechanism, and certainly vastly more so than the web PKI.

Peter.

v2.46.0 | Report a Bug | By Email | System Status