IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Nico Williams <nico@cryptonector.com> Wed, 01 April 2026 05:01 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9ABFBD48EC6E; Tue, 31 Mar 2026 22:01:57 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775019717; bh=Z7Qi699sF+wKeyA723D+Dn9lyzhzGbBT0iQusSTvUu4=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=dEvKqsJdg3JLQaMokjJ/vYuQNJIfu/e/1peb2zGy53/kLr9uTg3Ipzg70BqSIlup4 9EYGrcOGZY/sGOQdgham24ly8r+Hl1Vi5c6fTpmlCXKAQUgqKog5/Z6Me+qhq7WPYT 3FkoasgH1FIPVB4hrkliVxN6XXvs8NzpkWwu8KKE=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DRp8yTVpUcWz; Tue, 31 Mar 2026 22:01:56 -0700 (PDT)
Received: from dragonfly.birch.relay.mailchannels.net (dragonfly.birch.relay.mailchannels.net [23.83.209.51]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 779F2D48EC5B; Tue, 31 Mar 2026 22:01:55 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 568417E286F; Wed, 01 Apr 2026 05:01:48 +0000 (UTC)
Received: from pdx1-sub0-mail-a220.dreamhost.com (trex-green-9.trex.outbound.svc.cluster.local [100.96.234.227]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id DBD667E2736; Wed, 01 Apr 2026 05:01:47 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1775019707; b=YuTnOqBIrpbu1QDR9viItdfC9ALAwuH5Tu0w+drCFvRW7mEU1X8IRcWY9YZzRAp+73L+al 26zy2ZiaGhPDq+55r6JS9gjMavRoFFrbPNqb3YiS62IBiaxeewwVfJrjplEmCQFubpE82Z SdVdTbZ/KhxVP2pQVSpbmIKRwAA0QL1ygkATzgf0g97FezPMDi/hlSH6X0Zs+4kICabA9D 5fBA6UtdcdLVis6A9jaRdr210+tVW1PirZe0KyH9bh8cV6H78xQsqN/APo7InLFAKDA5Ba 30F4lqdDUeuYWWqaOqDrxWED8tFOUg/0qz6FYBOLw2+dH3kMx6FXF/WdaEDYYw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1775019707; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=0Tvw/P7/KbtRNDU1YlgjPsEJ/83jivZChf51IyiJqts=; b=YzQ6C9pmUs1Fn7zwzUKqMrNq2NH0/oBGXQvQbPiTOQM01zVN1uJQ02+lI1PNLhDo9C4VDL pUFUpI7/hFrFPAiqYgU+1C/Bd1RAvSuDLD6Cj+nPQpM9jkXmhi3+ZMaVaZYmUD7AuGem00 I+4kWLO/G9tWv0RmHIL8bijaQw0l+ZsEC8aDFn67iC8DjyxPRpZfPTjz9cYfxbcLoVtJQZ SYwx/z/Me384qUpnoWikVXeb3WRR3OL80TbNrwjMr5Nz2SHkstMMhdzeB2a5NDytSxIs/L 7tNYk/6+Vaj6lfUfU1DLK3e1XHiuU8knnf+xgaxLcbzQs0VahQTjrMfZvhV4EQ==
ARC-Authentication-Results: i=1; rspamd-bd48b9d95-kbv4n; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Lonely-Tank: 6b24ec2c0da8acb9_1775019708115_2845458487
X-MC-Loop-Signature: 1775019708115:3269942923
X-MC-Ingress-Time: 1775019708114
Received: from pdx1-sub0-mail-a220.dreamhost.com ([TEMPUNAVAIL]. [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.96.234.227 (trex/7.1.5); Wed, 01 Apr 2026 05:01:48 +0000
Received: from ubby (unknown [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a220.dreamhost.com (Postfix) with ESMTPSA id 4fltBG1SbFz30; Tue, 31 Mar 2026 22:01:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1775019702; bh=0Tvw/P7/KbtRNDU1YlgjPsEJ/83jivZChf51IyiJqts=; h=Date:From:To:Cc:Subject:Content-Type:Content-Transfer-Encoding; b=dIrtwy7btL4DESjhQYWstlWPwr7+7D7BDAN/iVIVFqkw1WvkVOtajvvQlQ7CQk6TS MhmHyTgtLDu9kNEtLfgo0CNwVhViYB6/c1+rN4jG6kQttJpvSzb6nSZ/Gs4c4MGvg8 rGL8WuNtt+hHEdWHQ4Iszb6I0lkEzBAFyZDGIiwIJnCRiACQOzvYwFGNpJsuFHzbk4 7N4EquZjk//f4uch+aCmmFgNSCZ7AcXOlGqxTdp/stTbsXeUe27GZeol9L7Z77lVcv n7KdV+/fc8Iwayl4gjdBqaYv7Ibrlmrgp9OkgfyLR4iaGw0KcrkaFwVIN6BXc7om70 dtG/88J72VVEQ==
Date: Wed, 01 Apr 2026 00:01:40 -0500
From: Nico Williams <nico@cryptonector.com>
To: Peter Gutmann <pgut001=40cs.auckland.ac.nz@dmarc.ietf.org>
Message-ID: <acymtCOiEL6TXox5@ubby>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <MEAPR01MB3654A3DEDC6A5E69B64B7A65EE53A@MEAPR01MB3654.ausprd01.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <MEAPR01MB3654A3DEDC6A5E69B64B7A65EE53A@MEAPR01MB3654.ausprd01.prod.outlook.com>
Message-ID-Hash: V3QU263VQ64TKKT5NADJKFPOA7WBN6OX
X-Message-ID-Hash: V3QU263VQ64TKKT5NADJKFPOA7WBN6OX
X-MailFrom: nico@cryptonector.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/i3xWJYOqWWQKRRf6m2KVaaAjIB4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Tue, Mar 31, 2026 at 09:20:52AM +0000, Peter Gutmann wrote:
> Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org> writes:
> 
> >The overwhelming response (strong consensus) — both posted and via private
> >replies — is that applications will just switch to TLS-Server-Auth identities
> >for the client side.
> 
> Or, to paraphrase a very old quote, "the Internet interprets one company's
> attempt to impose their will on it as damage and routes around it".

But this "routing" around the damage is itself damaging and means that
the policy in question has backfired.

Nico
--

v2.46.0 | Report a Bug | By Email | System Status