IETF Logo Mail Archive

[lamps] Re: [TLS] Re: Re: [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey

Nico Williams <nico@cryptonector.com> Wed, 01 April 2026 23:44 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id C7F97D533BEF; Wed, 1 Apr 2026 16:44:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775087047; bh=gNKyRKo3gtQI8/+YbYjS6auuOvha1Ky6uJOBDV0tIfE=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=qmvD6nphfIC0kYLZc+KhwBQnkCReF1ky3JUg8aQb6dHQnPg67tXcxW4SdH5XsukaM SNUIB7dJhBpEA+wFTGDKhf5H0P0cHDlUUiNm9CC2CJ65afIOE3oOa7a3ZD6wEKrYkG cJJlmZOsIK3BUxYlG0B6Wj63L8rDloPZSnorZdJ0=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SUlskG8h-_fN; Wed, 1 Apr 2026 16:44:06 -0700 (PDT)
Received: from lightcyan.cherry.relay.mailchannels.net (lightcyan.cherry.relay.mailchannels.net [23.83.223.105]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 311AED533B9C; Wed, 1 Apr 2026 16:43:31 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 6D632823685; Wed, 01 Apr 2026 23:43:25 +0000 (UTC)
Received: from pdx1-sub0-mail-a244.dreamhost.com (100-123-15-51.trex-nlb.outbound.svc.cluster.local [100.123.15.51]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id E9359823455; Wed, 01 Apr 2026 23:43:24 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1775087005; b=D1olxTQjBBZ9oxFhKuUSgGMM3pDjx1yKCBSV8hh2DVNkbcrSTETZy59oTo0gdEAeiuvN2Y zbuBc7ZTBd81EsL4tMLOmw8gfeJ9JpXeBPl4KvcAsMAf7ClZS7L0PTHz+/iQWUQCAe9+CM dP3I6U3oqMjCfcxnjZLsBxS7e3/Di2SpSXFW+ro9de7uAYjw6E8Cqz/aNeWQi7JXKPvgxS HmziKa8+GymIz8BeFQd4wHZid7ymqm1+c6CqbCrI3o0CVysCYo5uz7JV7t2vkQ//IpiRVB pbeqCcxXF0gvb2hUwtlMTNlFpb6aikf33RFTThpSsMKTKdDHpmeyzg2gjPiONg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1775087005; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=GKpc36/3HExI/wsde/EsA3PM65dofxo04JkNj5V49FE=; b=9kBwmAizcREsfii3PJ7LbyEo9bEb/zhPyrZQqJLvqt/PCrNU4OHm2yMANsocna8WGU4tIv apGqf9LyAaPkHTEmtvK6CuGMS1opHSVOI4NXnjdwq1HnY7iLCKqw0xuBISVhYFCuNe+VIX wO+q7qzS7gP+rcQE/M0nICQxYjjOhG3wVtycvXuhjcVLqUqfEy1qAbQcCh1mIbmzE3gwzy tO8p3h3mAOsf6EfhG1djaslYKlpHaRSjI4aN4M93vP43m/3GdJxSDXVTuBLqHi9Nftn0qi wEXSB2D1PjoYsc59VYGQzDGOcRT+AfBKG4zbyve7gf3Of1BRBT7yHWPjbymEtw==
ARC-Authentication-Results: i=1; rspamd-7d86dcc447-gh269; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Good
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Print-Bitter: 3ba373ff6fd59367_1775087005258_706582225
X-MC-Loop-Signature: 1775087005257:2336205808
X-MC-Ingress-Time: 1775087005257
Received: from pdx1-sub0-mail-a244.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.123.15.51 (trex/7.1.5); Wed, 01 Apr 2026 23:43:25 +0000
Received: from ubby (unknown [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a244.dreamhost.com (Postfix) with ESMTPSA id 4fmM4X1rVWzyrC; Wed, 1 Apr 2026 16:43:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1775087004; bh=GKpc36/3HExI/wsde/EsA3PM65dofxo04JkNj5V49FE=; h=Date:From:To:Cc:Subject:Content-Type:Content-Transfer-Encoding; b=P090boDXMiWQr519akDNZWkuDR45yc2IJGvDVweEGKB3jeQPK2kvcCZ5eFVWcYAz0 KhiJzGMj30MrOuFCb3N0sqwXrrzvJB36TxUF2q35HIClLrw5DPEjftqtbzoJtbM5qe l2/kTeNnS6bcZLlX00VEC01DtfkXDbHebof0CBlwdC5/KKZCSzqaCtNw8ZmTwof6so t019jZP1hA1p67gM9p3TaSvGXSAlmx7s/SJcpEHqHz6VIeB9NAsTgx8c4POrE02V09 JN2qRnHfZWj9SfOUHJx810BhbgxOBtAO58gFDT8kvE3oioQM6JxrVZl5eo36KQPeZ9 m2HEFtoAYENwg==
Date: Wed, 01 Apr 2026 18:43:22 -0500
From: Nico Williams <nico@cryptonector.com>
To: Mike Shaver <mike.shaver@gmail.com>
Message-ID: <ac2tmpy+sHn0yX5w@ubby>
References: <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <ac15yB5aylmUnjc6@ubby> <LV0PR21MB66238385ED1FFD508AE4B02F8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <ac2hvBKZUgEE78nS@ubby> <CADQzZqtoQk14dbcBqRZF5BT0jVQfJjaOzXDFrxeSj3coVcpXVw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CADQzZqtoQk14dbcBqRZF5BT0jVQfJjaOzXDFrxeSj3coVcpXVw@mail.gmail.com>
Message-ID-Hash: QZBWQFMBJDNWRMM3VK52KN5E5YVGXH5Y
X-Message-ID-Hash: QZBWQFMBJDNWRMM3VK52KN5E5YVGXH5Y
X-MailFrom: nico@cryptonector.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Andrei Popov <Andrei.Popov@microsoft.com>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] Re: Re: [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/tSICbTnfyBusTuEKJPnm763zPiI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Wed, Apr 01, 2026 at 07:36:44PM -0400, Mike Shaver wrote:
> On Wed, Apr 1, 2026 at 6:53 PM Nico Williams <nico@cryptonector.com> wrote:
> 
> > Though someone just wrote me off-list that:
> >
> > | I know at least of GlobalSign Client Authentication Root R45 and
> > | GlobalSign Client Authentication Root E45 (but have no experience with
> > | them).
> > |
> > |
> > https://support.globalsign.com/ca-certificates/root-certificates/globalsign-root-certificates
> >
> > So perhaps not all CAs have exited that market.  But this is just their
> > root certificates; I've not yet found how to get a client certificate
> > from them nor how much it costs.
> 
> That seems like research that might inform your future position on these
> matters. Multiple CAs are offering client auth certs under separate roots,
> and servers are welcome to trust the roots in question if they wish to
> participate in that particular PKI.

I did a search a few days ago and could not find these, but did find
that some CAs had exited the market.

v2.46.0 | Report a Bug | By Email | System Status