IETF Logo Mail Archive

[lamps] Re: [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey

Michael Richardson <mcr+ietf@sandelman.ca> Wed, 01 April 2026 22:59 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id BC272D52F58F; Wed, 1 Apr 2026 15:59:15 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775084355; bh=bhVKKfoGElv954O+Z2o9Bj0ka47HBDx5TTZuUu9aWNY=; h=From:To:Subject:In-Reply-To:References:Date; b=me3qHAPWQsCIcipaG4bzQcOJzDx1wzXIRcJDouHhsofIj6xGeluEMTQU7insfoFe6 cigfwef5friApeeilDdfExgQ/z2JAMVS9lxm3/sFB8Mg+GkPB3/Q5P2woDrMGs6dX/ ldQC8m16y51foyCPcNATt2MuLV/t8jPv83RrTwkQ=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.8
X-Spam-Level:
X-Spam-Status: No, score=-2.8 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=sandelman.ca
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V404cPUwv6kr; Wed, 1 Apr 2026 15:59:15 -0700 (PDT)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256)) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E6883D52D1BE; Wed, 1 Apr 2026 15:52:37 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 99D7518010; Wed, 01 Apr 2026 18:52:37 -0400 (EDT)
Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavis, port 10024) with LMTP id sTFfuRSXB9ES; Wed, 1 Apr 2026 18:52:36 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sandelman.ca; s=mail; t=1775083956; bh=PAgIUlzLk5vOJll+m/WvXyFSBlfmjEoRe0TqyoSA8DM=; h=From:To:Subject:In-Reply-To:References:Date:From; b=Fhs59eatQIibyb584vXYSFuUOKIbPg+Oc9r13wfUJXnSkO4lGY0huFtjB7q+OQkf9 H3RM4YVZyGzMy2bF9MzkN1kx+VF+oF6H1bOFUASVVKirDLGyg4LI+jRDGv5huoknBM 0fIhw8qoV5ln1z5BjyQQH/SkaIlFF3mxoRJCOvB/f5haeJSls9kT6irAqUNX8xslgf 50qeSg/H96TubJSaE7+17O1JmJjSZyFzt4MpGdUOC1nvNPV9/QK2DzjdQA8S/QSEcq 5qB8z4e87wGN4YMNWtdunlC6p8nOYW/S0zzGTEfQFnuhFfH/Qof2LlKkGkbdOszbtq 1pK+U/D/Q1s7g==
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 5450C1800F; Wed, 01 Apr 2026 18:52:36 -0400 (EDT)
Received: from obiwan.sandelman.ca (obiwan.sandelman.ca [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 4FA7D180; Wed, 01 Apr 2026 18:52:36 -0400 (EDT)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
In-Reply-To: <ac2f8oID934kSCFF@ubby>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <AE27DD88-67C5-43DE-B23E-A2DD84714F36@vigilsec.com> <CABcZeBNPsiG8qAWaAGLc665-jQMu-aBTDf34kbVGcSdRN-NqJA@mail.gmail.com> <ac2f8oID934kSCFF@ubby>
X-Mailer: MH-E 8.6+git; nmh 1.8+dev; Emacs 30.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0;<'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha512"; protocol="application/pgp-signature"
Date: Wed, 01 Apr 2026 18:52:36 -0400
Message-ID: <11805.1775083956@obiwan.sandelman.ca>
Message-ID-Hash: O6XFKPPJMHKLVBQFT2RPDQUYWKDAAO3R
X-Message-ID-Hash: O6XFKPPJMHKLVBQFT2RPDQUYWKDAAO3R
X-MailFrom: mcr+ietf@sandelman.ca
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/dYDD1eYVy7p57Nhpxb9ECRJbYqE>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

Nico Williams <nico@cryptonector.com> wrote:
    > But also: how much does this differ from changing the Chrome Root
    > Program policy to say that intermediate CAs chaining to WebPKI roots can
    > only issue EE certs with clientAuth when they have only dNSName SANs
    > (and either empty DNs or just CN=<FQDN>)?  Because this alternative is
    > much cheaper in terms of code that needs to change.

Yes.

And do we have any chance that NameConstraints can be used finally?
and/or marked critical.

--
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

v2.46.0 | Report a Bug | By Email | System Status