IETF Logo Mail Archive

[lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey

Mike Shaver <mike.shaver@gmail.com> Wed, 01 April 2026 16:10 UTC

Return-Path: <mike.shaver@gmail.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 48860D4E917F for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 09:10:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775059801; bh=0CI/xuV6NAkhBSjQ/cAZPPAA4CvcS5ScS3+QqnxJSS8=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=wbG7eQcyflk090J68rwWSna7Fjj0aLYUZMlh20xVqCXW33GJGnOveIUKQAP3A5iWM 1PzCSFrbfcaBCT+juJ9Vi2cik/s3qZgBjk5QX5HVcNXh3bPvBdAvj54IzTTOFYLHNy e+ON3E576AgGTQl0uqJ3mJ1QqF6OCr8UoYEc0fW8=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i2564dPuu56W for <spasm@mail2.ietf.org>; Wed, 1 Apr 2026 09:09:59 -0700 (PDT)
Received: from mail-oo1-xc2d.google.com (mail-oo1-xc2d.google.com [IPv6:2607:f8b0:4864:20::c2d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B2FCED4E914A for <spasm@ietf.org>; Wed, 1 Apr 2026 09:09:59 -0700 (PDT)
Received: by mail-oo1-xc2d.google.com with SMTP id 006d021491bc7-67bb39a1122so3650678eaf.3 for <spasm@ietf.org>; Wed, 01 Apr 2026 09:09:59 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1775059799; cv=none; d=google.com; s=arc-20240605; b=RMe33o4RVxTlo5LRoRtW5eaJJ/sGe69SrFmNK1BASFQrd0/Oh/Clt0Hd5Z9H/eYc6e b2GrgSm+ZTwAgtfTND2are5pUbJkk+ebSz2g5aA91N5x++xYarOAGAZt68Qiqf84ulfk top6ke1Y5s3qLYJwuEyYr3Y56RxdLD3Jq16G3+bPr2zmt/XEqb35d8eCqUhCHn1GTgYs K39zf+ROBAfhF2hU609L8ZWwlMW2DkXBFExly1KyCy/QhLDqbeS73w4T1ZMFhGVIM+cc HuWrtcv/Xb0/Fq3yUB6+qvm3xKolhweSaaMi8R9ThKRyzRl5z4v+QhlZ2z99Df7xAnuz tfpQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=0CI/xuV6NAkhBSjQ/cAZPPAA4CvcS5ScS3+QqnxJSS8=; fh=Tt9swiyH/NClHZ3Tdv2jKbP+UQAu3sLuqJOP5cQPaYQ=; b=Is4Pm7EbwAOKGan4ROj85SFVXOgyb26XbR11BQHqnNNtr5LAR16Si77QE2eX6ORLBW ut1Pq3Vbx0+8otaPMm0EZoTYmSxwsl1VkqatLfUrDahtclqh1+n0q8gOp5sQ78fIv1jN dElN31wJ+tHfW/WC+cQvAqpO7f1EAkVJ7Ba6hBr8Oy5LcfF+toTwSgAOvXLdUyt2zb5m 9DZz74vP9BB53Ig5AGzGHJFJ+7dogU/k7PsISdhZ71bjUK2h1vIbPYxYjd8QfuhNZF+A j2UnR9sgGVRr3IHjEH3P3DD76atWwajj4YS6eTiY3eUs/XQrfH1e6X5reJG3EQzgwvlx T9fA==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775059799; x=1775664599; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=0CI/xuV6NAkhBSjQ/cAZPPAA4CvcS5ScS3+QqnxJSS8=; b=qS2Llykohb7OA2HyaTCfXogl7udOLHSHLTtQCGfk1TNqwT/tZaS9B6oCGsIbnpyRAJ IPBEFGYtiQ7i/dJvWOwas/6F4mtSZeROQdioP4avpKXUxw/htF5a71enCyb9NpwuvxML 5wf8lbfQc7HZGA+v9+/H1QCqAkeqItLi1Z0EZDiRQWx0mnPW0fi6y982U+vAMcU7Pz9c Zftn6K6JWOo9NIIfsRdvQ9grSRtVJ5jxrxXtIqRZpqxW6Tjw1SHgkh+tqhfaV/FljsAj KTeKRojbL05UCj/YT/YMNEg9qSqFeacvvRJUZc9v5GYR3xz3XnByVL5uPP2/XG/PBZjv AO3w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775059799; x=1775664599; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=0CI/xuV6NAkhBSjQ/cAZPPAA4CvcS5ScS3+QqnxJSS8=; b=emR1Rgmq5CMd1MKcDKDC0YDmnv+SWzY7wZOkXalINetzlnqlSmOIpMIrIBlwa+RMha X//nCSfPQT1m9lluUNgX4aUIeJ+zC67vTGMhNgynjwFrZjpLJrQP521Frq/b7s3KIu+s BdCB56xGnPJLWhoWu2SVdgLYu/69fWZOap+64PWc3t/hgLuK6GvL2U6duyVnXQj0OAIK BewMd3Hj5nLlJA6jAr5I4kOFh7e4+KU69fWIM3GQyRWM7FzucWHzcOk2kIOJYHM/G3NC orc1I/esau06jYoEpXCLjXRbCHqXDKXm+O1s1mcpaqm2TVjzMaosl3gWBC9iHGuNhGPQ +ldg==
X-Forwarded-Encrypted: i=1; AJvYcCXpE2HV0rG4SbFEkNQJXR4lcN9kJuZvWIlrgB1VDNLGKWg+2z5YBTRydH/vhXroOwo0tbqBIQ==@ietf.org
X-Gm-Message-State: AOJu0Yy0QdI5pdgRFILFEQhD6D3/NnASPkDhsGGIonX5Lqva2iH3mWrj DctT3XGfJ1KtK4Y8+3x/KktCojXJYLCd/9Xi+DDBb2lWrDPrPH3HcRj9m+8T6xcpdNvbMSMrAnX 7AwkgWraAbnGNQTq0z6jE3NnsaqNX4Wc=
X-Gm-Gg: ATEYQzwuydutnCx/9BnAiSX4khdab/DbY+fVApM3sVueJqMTJATZlIhENdDrGhUDmub f0Tg/DrLDty1GsJV8al2/p4qTLSOm+RhC/tSGayywmS+HblnzELQCjNHW/VTlj8pIyqA8ylEBav JJRw/5S0sDa04E1lEqKIaA3Jnq6AH1RBdcJoxEBz/+249AdEMID1XooDy8S/1ZeoRDZlDJ6GcTM 1JJbhhSA6IKDpE++ki/S/2HDppF1CVzxSBfS5ipAChw3Gz9dzzozg9EHfeORLJZUT0OWUZCMjjZ NY6nt6s=
X-Received: by 2002:a05:6820:1524:b0:67e:aa1:882e with SMTP id 006d021491bc7-67fabd26e6bmr2188921eaf.62.1775059798647; Wed, 01 Apr 2026 09:09:58 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <ac000NJH3A1MaZR/@ubby>
In-Reply-To: <ac000NJH3A1MaZR/@ubby>
From: Mike Shaver <mike.shaver@gmail.com>
Date: Wed, 01 Apr 2026 12:09:46 -0400
X-Gm-Features: AQROBzAXnG8pX90xDLa2Xeq4sPuPSQo4zPnGDW1toO1BtjWEHwK9ijMl_4hDoWQ
Message-ID: <CADQzZqsT0qrCyusarQY1AK6w4M8jSbA8V-f+va7U-tv+KMUd1Q@mail.gmail.com>
To: Nico Williams <nico@cryptonector.com>
Content-Type: multipart/alternative; boundary="000000000000c0e7e8064e68502f"
Message-ID-Hash: DU4DIHA35ZMEDNJKEJIY6IY6JA3XY4ZR
X-Message-ID-Hash: DU4DIHA35ZMEDNJKEJIY6IY6JA3XY4ZR
X-MailFrom: mike.shaver@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: David Adrian <davadria@umich.edu>, "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: [TLS] Re: Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/vvdY0ZS7xmmFe4JGuLqhN28GC38>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Wed, Apr 1, 2026 at 11:08 AM Nico Williams <nico@cryptonector.com> wrote:

> I don't see how the IAB, IESG, or IETF can possibly accept the program's
> policy change


Why do those groups have to "accept" the change? Do they commonly review or
require changes to browser root programs (including the Microsoft and Apple
ones which are aligned with the change to clientAuth issuance from included
roots)? I've been quite involved in WebPKI discussions and I've never
previously heard about IETF or related approval being required or even
appropriate for those programs' policies.

Are there other elements of the policies that you think should be subject
to IETF approval?

Mike

v2.46.0 | Report a Bug | By Email | System Status