IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

"Salz, Rich" <rsalz@akamai.com> Mon, 23 March 2026 18:08 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id AAFCCD01747E; Mon, 23 Mar 2026 11:08:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5qyEYt_3Mpuf; Mon, 23 Mar 2026 11:08:04 -0700 (PDT)
Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 50079D017474; Mon, 23 Mar 2026 11:08:02 -0700 (PDT)
Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62N6wJZe3767642; Mon, 23 Mar 2026 18:08:01 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h= content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=jan2016.eng; bh=7ehLM4W4LFIQSZfua/4NKK k/xQ36KfWF9fuecVBmFt0=; b=FV/7wWUG+AqO/sVp6hAZbA//jsncMQSmOf2xad P9dLcNFOQ2cyAKhwStAlHFLYiG+tyhHJAZRcrZa0lihxkcWQNko9GxCZAtSOB8kj mHVz9wafK5hmoLHDIUqLj15I6aEmHOt7nMzuhybWmS0ljgWM+nL+/PVAK6p7seWX ue/NKzdyt5Tk7bHlGh2R+15IQklKNbI8U797z1gbISjZLk8A7bx0Lq/si7O8Pj8S bdnQcxoYDfECblA+dY8SqAHrop8Q/JLR+aw79ibTeyVYoT3lBiTU8YEplaB/US63 2a0cb+2cTElngOyi5VWGxINJYiqY70WBuggDjLjxe4QhMxOg==
Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by mx0a-00190b01.pphosted.com (PPS) with ESMTPS id 4d1kfay6f9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 23 Mar 2026 18:07:59 +0000 (GMT)
Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.18.1.7/8.18.1.7) with ESMTP id 62NI4UTB013349; Mon, 23 Mar 2026 14:07:58 -0400
Received: from email.msg.corp.akamai.com ([172.27.50.203]) by prod-mail-ppoint2.akamai.com (PPS) with ESMTPS id 4d1pnu0nm7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 23 Mar 2026 14:07:58 -0400 (EDT)
Received: from ustx2ex-dag4mb6.msg.corp.akamai.com (172.27.50.205) by ustx2ex-dag4mb4.msg.corp.akamai.com (172.27.50.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Mon, 23 Mar 2026 11:07:57 -0700
Received: from ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) by ustx2ex-dag4mb6.msg.corp.akamai.com (172.27.50.205) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Mon, 23 Mar 2026 11:07:57 -0700
Received: from BYAPR08CU003.outbound.protection.outlook.com (72.247.45.132) by ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27 via Frontend Transport; Mon, 23 Mar 2026 11:07:57 -0700
Received: from MN2PR17MB4031.namprd17.prod.outlook.com (2603:10b6:208:200::22) by SA1PR17MB4772.namprd17.prod.outlook.com (2603:10b6:806:19f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Mon, 23 Mar 2026 18:07:55 +0000
Received: from MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7]) by MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7%3]) with mapi id 15.20.9723.030; Mon, 23 Mar 2026 18:07:55 +0000
From: "Salz, Rich" <rsalz@akamai.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
Thread-Topic: [lamps] TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7W8bJqAgAABwBk=
Date: Mon, 23 Mar 2026 18:07:54 +0000
Message-ID: <MN2PR17MB40317885CC56626E863E4F32CD4BA@MN2PR17MB4031.namprd17.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <4732.1774288835@obiwan.sandelman.ca>
In-Reply-To: <4732.1774288835@obiwan.sandelman.ca>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR17MB4031:EE_|SA1PR17MB4772:EE_
x-ms-office365-filtering-correlation-id: 6e047048-020f-479f-6b1a-08de89071b5b
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|6049299003|376014|10070799003|366016|8096899003|4053099003|38070700021|22082099003|56012099003|18002099003;
x-microsoft-antispam-message-info: bfqcS4iK36ylFhKjl+JBp3TQAuqvLsNPWhYw6a0yC0WvdHwYBrk15u4vpTy1K8K8wQOktObNiDZ2AVLH4Z8InpaxLzZoyfGAnCgo29q24u39sbPb5Z3FKNEoNs3BfcDAE1k7X7XLTjtUsM/r05yqwO+taZKoPGrjgjF9bTjpRv5fcWzyiFN9SQqnnROOzX5JgjuwCpAtkp5YPboyVwTrwew+HTgBHs/CjjCYsWqwBI3+fvNewhbCwleqH2Q+ZoEkWVsD82rBkN4AesvlNf/4nI7xkJabl3FeHEaBGrWqw7dE0kMrv0mbuvlxTTppjW8Nmv53lMe/+TDZ1O0/YC6p6iQLBHGKSCwukUUmSdU19eQues40PWE7SRGDbRRKogA3eirwCtL5O8fygfHBwvCBO53/Gs/DyLMKIMVxplrADXCz93C8LmqkUranRxt3NZDVjMerUx6xeBg/b0aVxWh9P5B7wf+P6TH0f4vMIKMvLJ1rG7imWK6DlQdG/h3Doa7AyhFdhig2yKQ4UilG8trZm0FSUV0nrULZmlXhPa1guRBgT3REHunq/OIK0njpBdcCF6E7dC8Hzw2YbJjvx6EMk7KCyPYanRhpn5BIsTOjaSailG2Ymb2nCBKB2QMLekAq71igvrZOwYe+xGSVodfN0pFp1gcFkQXxH1OXkTHwmREFnACbNrJTLRgJmf476WM33lmHCMIkgaDUaqDitmgiKneYIHXwi0gB2/TeoUcF7ww=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR17MB4031.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(6049299003)(376014)(10070799003)(366016)(8096899003)(4053099003)(38070700021)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: FzfmPWixpIdw7TfyypZR5g4fpxjgii/KFVy5tuA4OsCFqmxhbSnujBvIyxgzxDG9a9hGt94RBMTzpBkwxTeSlC/nTMdRkFGuv7g6Ze+hFyNuJr0iIFgSHpBM5Y9KF8Tl6cw3FohAs5qWzL1eLU2IO8KTt6qHPy05jpfWpvx5+TFtvijJQPaUe9/yu5yDCnolVNtuvkpZFjLqr91oFSzsYCofMdVyrrVD4kl+smnKxPnFNitRJogOvuSnQIFBwguimBA+dfqrKqJYVaMqh63aL/MCrwB44k96jSpgHXtW77C/9Fu9V7D2DWObGs+wjKy2EeZMAzy2X3XhA9c/vS1jKXunxo7fiuRTrY91LwJx6uhVik+VYYLqQF5xiMh3pEkR9eIXlkMurQ+Mu8sOpMTbCWa38UOFWmAE+uvoONc1T8ZufNhQqTu0pprQde/HWD55CR9iZ1rXEfcvcZ9HTR0HpxSkl5WF/T6+OZbMdurpuL1QUsTc7BOEWwGGFKEcTBek9lDKTBIZNf6p5v7JjdNC4+hk1GSaAP8EwA/6KQs2WPBXg+/yhjA6fz5eZcmxcNj+uksuDURCjKum2jgBRbQYt/rTdORKiRVnRi97cIJgdE6l35Kc8Q70+QHI4PjZya9pyyBMuWBu7CtvjpiOOmUYVZ5eFSjUos2gfJ2WkrbLjkdcP2ZEHBtvO1f6/tELUG8dx/OOkTuavaZkUVUmTydx3/osmZH+eVMyjshaN1fU7Ia4lVDukRxNlMmfuvOeMwFlrgtcgoP1kyHtpMExfCtd+59gW6HjSkNmRLW8cM3eLnmHC1vxki4o6jp5gSuYNX+oUmTjHcLXo8cARuhabQZWBE8PdVE9yvJLZCeoMw9BZrlxCp09TCIjkcKDUmbEuW4mV3Rcyaf9FY3ILxSmCu2u2Ir9I0YOtoSwDfU54/x0PzIii6+ECBDznOsIg8jucFdmx201xZWGclxRo61kedyL0CjRxey9fBf2TN+DPOWBWncrtutquqN1DOJzsJ+SH6a2QpMaCC8CSb3KnbCx6FlpsJuukF4STqvZeaXAf2rOK4ciaMmWfl2Ays5Prlj6tsrNDi98nri4VSy0uef1X75h8zupK6PO7HRGt3LIxWusdSCKvAnle8wV90loZzPJ833UqunTtiMh6dJ8D8rQtw02qRYbTb4aS9qL/Fa5oa+PuEJ7jUG5VyQ3nVVgBpl1WqVhqeMZFxSYzj0EWe7feQ1NRsvJiOPyw6yfagX3oMHoaB1weL4wFrXurQ2ltNWXrexKg7l8pFCoXYjO19QEOm3CtyHGweh+JxLfTFKLWE1CZQldpv/ZEy/696BZnrZqier9mBzS3YtAUshG2DXC66ZSuot/oFzzK6uQU5trNozZTOggzliHtBZKsgs6fQLIunrBfLRKMPxuCm48t5fDo/c9ocatXyFI8LDPFWVEeB5UwVpLY6DTyQ7llUQL6VwPQCHqkP85edckJOK+BE9iwIzdepMT6wg8JSo5kUFIL6OUA6PVqv374gVED0CuVfIwJ46ACt4GCpFpQZ8G5LPzSI+5+Vl9MMUBZW5HDLIXDYxgbqvHTv7HVmmPICGmuDKwI6ue94V1aOSPxcmi5Qfg+TEHqtpL8Y9sZ9qVjpAONJczf+23IvU/pru4Yqao9XpsqW0Wn/cxb/pPVV6ePZnLZ/aJn7m38GSVfVJ4vQOdxN3HCHAbwE/Cwcbfv2RN/lQWscgqtzJ3XZ1jIdJTH5+rfWxwkIwNDF6YpGNIauY8jVHurOJwRZY9PV6YQYKiPAvwbFD17YXOs/Z1
x-ms-exchange-antispam-messagedata-1: fr/cXM9+D4Wjgg==
arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jRRYWlsHuqCFiQ8Q3GBbSIR2SOW8KlPxW/5jVNK7YfhYb6Pr7LlNF71d+DrXaN2gq2eMJZGSEbMXVUDMmTqn7Nvs5ciiG9y8ej/RYixNS4Rjlbifp0mtqlK5tnEIi4zMRLygTp6mnKH7eDufEVXJPnrI1V1iCU41afPu8hLksO3OrL6KjuemqtgBHjjMerKEBQwIjBPGBPfGeRk9jX7L0gbvI3vxQ6LyeUPQIB4O69dHy1mLMyIJbf4IJsdVzia7/A0TWf62VIKj7UjBNUOkdgszvjnNoMfhoKSXgJgVOCaACkrmQ/1dpaVkbO0FaRHF/HvIb60OkwIkIGYrT4Ovuw==
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=QKA9Vm5Ke1335fF2PNztfW3rXtXbpMDL1221C9VXEAk=; b=PUmKRfexUOcsd+bQIrgIyKYogvC4d3Al6NMSyDNjxjXo37DHmdIctKYHu+bfpXia0iLUttewIMHkUfEyQJCt8X48Xsk5Kfc4N8VlHXAg/1gytnV6V5aZvyZLUm/ihb5YGlXMolnxFfVHFbGmemZ+kRdYbrDu0vVhMuJuhKjxBzz2zlKdEVH0FC1/1VAhb50CqWASfzWNPIpLBMFuGWEsPhpPURYpIqgM9N6jW3AQMTx+oueSVVmPLGG8zoZTyoEnGkN6CcQq2B7dlJYeB5kKCHJx83jlO+jveWPj8Y8l5x5kynKEPGOBHgWmRhXjKlpDaSC0mg09VbonE1TG0aIo4w==
arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=akamai.com; dmarc=pass action=none header.from=akamai.com; dkim=pass header.d=akamai.com; arc=none
x-exchange-routingpolicychecked: bwoin3iMKrI04yo8qL1UCP2uzwwX1zQGW7DJmqoa6wW24a29oX7SlObBtGMfWKOgNEk1/UwblLA3ywOHg9xdSHA3uV+TdL8V3tINar5nhR4w2q7gXmot9O98g79WXOVmom/KB3LOzpfsLv+vox1Uj/JXkBgi/kzsZJMm1rUS+LK++Qkl49cv/PgjBN0kfpRJX1UVZeCwidOJQ22DNa7OxAJYKFJPyQf4nrAhDGsNpRA3fFaQkZCFdIu2IUXHBl/tzRm5h1xTUJETmkbbTucTgtBSOseZIdSKlgGWZfk7xqCctWL0g28MlU05DhpP1emjW/FJsKQdQXiSIVs0UiVtMw==
x-ms-exchange-crosstenant-authas: Internal
x-ms-exchange-crosstenant-authsource: MN2PR17MB4031.namprd17.prod.outlook.com
x-ms-exchange-crosstenant-network-message-id: 6e047048-020f-479f-6b1a-08de89071b5b
x-ms-exchange-crosstenant-originalarrivaltime: 23 Mar 2026 18:07:54.9783 (UTC)
x-ms-exchange-crosstenant-fromentityheader: Hosted
x-ms-exchange-crosstenant-id: 514876bd-5965-4b40-b0c8-e336cf72c743
x-ms-exchange-crosstenant-mailboxtype: HOSTED
x-ms-exchange-crosstenant-userprincipalname: FKAOR3cmk2HKJdO/MTi6irxPvDW75bEnETVx6ZfcoKGX8Q0BOb6g7a1pfdD5bWRhAC9oQPZ2NeZFATNuePE76g==
x-ms-exchange-transport-crosstenantheadersstamped: SA1PR17MB4772
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha256"; boundary="_32CA250D-5194-9040-B5D5-DA0B1649EFD6_"
MIME-Version: 1.0
X-OriginatorOrg: akamai.com
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-23_04,2026-03-23_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 malwarescore=0 spamscore=0 mlxscore=0 lowpriorityscore=0 suspectscore=0 mlxlogscore=908 bulkscore=0 adultscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2603050001 definitions=main-2603230133
X-Proofpoint-GUID: nVhVvzu3CcJhzU9-OQon6uqnKVyY9ZfH
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzIzMDEzNCBTYWx0ZWRfX6L8c4clAV/ZL Y/kTDU1PxCdTq35V1pq49McZ5vl0vV9y1hVNPSKh/zxwT1cgUbjexAnG4oBJjgrtDC1R7SklXOy lAd9/nyNCvtlYzEj6swQPi7tBj0R2MQdV0tuOlKuZXfvpL8hPQw31FNpY242xUnpzi75e2C1aaO rPnkeELTK58V04w2xPakcjevbHQPlBCrf3sWWn3uM5Dm3yp08PpBVNVZSJD41jG5y0sm/UPUatA u+SZpRQsxFFQLdcgdLB+VxqAmUOJmpa0uYc+LWpoBcTemNleqnFcVxc8NI/tfIkSOj1fqn7HiUP QEDUZveed92pzftDtC201PLNG6i78/Ox6oAWADrN+atS3v/OIJa3mn1XapVZl1PlKqxzQIyaYEu lXOtliPjnXJ6ulPvr2m0zWt4q6t59Kzfx1cYzjjxy1M9bcShk3gpfRxjNp0uV7OyG0g1wL9NEW/ BKZXqIGZogQSw14BxmQ==
X-Authority-Analysis: v=2.4 cv=e5U2j6p/ c=1 sm=1 tr=0 ts=69c18181 cx=c_pps a=BpD+HMUBsFIkYY1OQe22Yw==:117 a=BpD+HMUBsFIkYY1OQe22Yw==:17 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Ifg-1AOnLHOf1gn6spyb:22 a=5uIk5skAYop0meUMGpPt:22 a=lAb7ZAX9T_TasxCcTl0A:9 a=QEXdDO2ut3YA:10 a=QYBW3BZQ03jn9Bdu-8oA:9 a=FlGVyfqBf7L3jNxS:21 a=_W_S_7VecoQA:10 a=rQdsG3aHWjUHY18OWMEA:9 a=ZVk8-NSrHBgA:10 a=30ssDGKg3p0A:10
X-Proofpoint-ORIG-GUID: nVhVvzu3CcJhzU9-OQon6uqnKVyY9ZfH
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-23_04,2026-03-23_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 adultscore=0 impostorscore=0 malwarescore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603130000 definitions=main-2603230134
Message-ID-Hash: QEYXRI2ZHIKKENOIHDVI74FE2JRXXCNC
X-Message-ID-Hash: QEYXRI2ZHIKKENOIHDVI74FE2JRXXCNC
X-MailFrom: rsalz@akamai.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/ps8smTIJOB6oJmpTVM6K5DgkPYo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>


* You say this as if it's a new thing :-)
* Is it the "change" that certificates obtained for code signing or email use
* will have the tls-kp-clientAuth EKU ommitted?



Chrome has decided that they will not trust any WebPKI CA that also issues any certificates with tls-kp-clientAuth. That is new.

v2.46.0 | Report a Bug | By Email | System Status