IETF Logo Mail Archive

[lamps] Re: TLS Client Certificates; a survey

Nico Williams <nico@cryptonector.com> Wed, 25 March 2026 05:51 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: spasm@mail2.ietf.org
Delivered-To: spasm@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 9EC1BD105F74 for <spasm@mail2.ietf.org>; Tue, 24 Mar 2026 22:51:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dz28S1ZEtzb7 for <spasm@mail2.ietf.org>; Tue, 24 Mar 2026 22:51:44 -0700 (PDT)
Received: from aye.elm.relay.mailchannels.net (aye.elm.relay.mailchannels.net [23.83.212.6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 0B34BD105F6F for <spasm@ietf.org>; Tue, 24 Mar 2026 22:51:43 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 90F7D76215C; Wed, 25 Mar 2026 05:51:37 +0000 (UTC)
Received: from pdx1-sub0-mail-a220.dreamhost.com (100-115-142-207.trex-nlb.outbound.svc.cluster.local [100.115.142.207]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 39722761E2F; Wed, 25 Mar 2026 05:51:37 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1774417897; b=d2pFxICXaH00VuP89SZb7rUtdeGeokCo+GbLDCm6bPL/fMBlR9XEzlpvtziSslJm3SInT9 Ks6GcdlvMgKdXiL3xCt4xzEnzrchsrOnZX454HicsEb2Pvf0lRf3ZDEKuPebj4atYOs20I vILLHNTLJxWNB/gSrtiBikBAtReY3Mc9cqj+ie9o/lrgydtsBLPVD2r3n2sjkfJSwqlZ0P hvaYJq/ZCJHJn95XZTiWWP5qQ9dW8SUrjoP7vvdxsTcpDbOY7qADVecr51tuAxtS0KELGN Ukggu1H0hZoZXVqo/ejQdDtfD6nW5b9/0po0T1lbqS+SbR/KlBok6WWkOl616g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1774417897; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=kStMlFUQ3Q/Y54aMr+HVE1Iw55AVCxzb6Y3tRB+1az8=; b=SicNuzET5uHhVGbJ6oQb30Y9B8ghl5mchK11dgzHuqUC9yJep403dJgTphdTkpPJmj599J l3YQGJTwrZ2WZRT35ObXuryho0b+jHXX9iAVbg4Q/NIrbz26nxwARPMYzGAiScziOQCMqe uty0DuEQhgHDzVlgCq9E9oyo3BwLM9UlwHHsl070AMcw30go3hXG5nFp6UyaN7eBVhVUzz jR26J6GnWTK7lBweD8eOb0GGrwpDk1a5Fp6sDsCRamS8D0vwcVDg9z6HfrVpwqA2oSjyeq fUto81FWMKUU2Rza94AoKQ+N8VVRwvxGvJiiTtlTJSBX5fQtIryZUW84Ski8Ug==
ARC-Authentication-Results: i=1; rspamd-7f98bb5847-8lg6m; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Supply-Trade: 1e48764026c45a74_1774417897444_1666768907
X-MC-Loop-Signature: 1774417897444:4028631600
X-MC-Ingress-Time: 1774417897444
Received: from pdx1-sub0-mail-a220.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.115.142.207 (trex/7.1.5); Wed, 25 Mar 2026 05:51:37 +0000
Received: from ubby (unknown [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a220.dreamhost.com (Postfix) with ESMTPSA id 4fgbd44Jrlz84; Tue, 24 Mar 2026 22:51:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1774417897; bh=kStMlFUQ3Q/Y54aMr+HVE1Iw55AVCxzb6Y3tRB+1az8=; h=Date:From:To:Cc:Subject:Content-Type; b=OvwOqP1HYqv9pKT4r2Ow323sVq31pCaC77D/JRq9PBwR3qQ4Kt3VcwMPaGTQvyjk/ mNvTtpddeqBSJHcq4HZISvLW3H0q0pEBLAwtNjEpoKa/vwPK8qEVGluL59JJX40chq o9p4L4uiugY1cqI5o/57O1VPN25DBoAiNei3cEG/rzWsY7E1YJpZw/LftOOcPkPodY wfxUvB2LJan3u86KGzYjx5hl+6lPOVJtrRdSP1Rt5+ZMha5nxnRzDwGZsSzvYfOIlI LC3Ky6Ka/twrXPMNSnP+x+f5d7A4qKSU0pxWoD6yPz0hsajfsgm6gBwAG5lB1QDnIb p6vlmmQOF9f9Q==
Date: Wed, 25 Mar 2026 00:51:33 -0500
From: Nico Williams <nico@cryptonector.com>
To: Wei Chuang <weihaw=40google.com@dmarc.ietf.org>
Message-ID: <acN35XZTbHg4BsJ3@ubby>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <4732.1774288835@obiwan.sandelman.ca> <acGB3/g8HMNNOP4J@ubby> <f6bfea57-f9b9-48df-9d9a-45978460e881@gmail.com> <CAAFsWK02e4Q5+VkB3wPOXkT1W_apLu8Sz-66fxcAKwsco0rfEg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CAAFsWK02e4Q5+VkB3wPOXkT1W_apLu8Sz-66fxcAKwsco0rfEg@mail.gmail.com>
Message-ID-Hash: XU3WPRMBXH5FWHI3DZOOZCQWAGTTAD5U
X-Message-ID-Hash: XU3WPRMBXH5FWHI3DZOOZCQWAGTTAD5U
X-MailFrom: nico@cryptonector.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-spasm.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Seo Suchan <tjtncks@gmail.com>, spasm@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [lamps] Re: TLS Client Certificates; a survey
List-Id: This is the mail list for the LAMPS Working Group <spasm.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/zhmio_5NEqMEzOatcJ7GUJABm1Y>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Owner: <mailto:spasm-owner@ietf.org>
List-Post: <mailto:spasm@ietf.org>
List-Subscribe: <mailto:spasm-join@ietf.org>
List-Unsubscribe: <mailto:spasm-leave@ietf.org>

On Tue, Mar 24, 2026 at 06:36:16PM -0700, Wei Chuang wrote:
> Furthermore, it sounds like some of the CAs in the CABF are thinking about
> a WG for Client Authentication.

As a postscript to my other reply:

On June 25, 2025, I opened issue #604 at the CABF only to be told to
contact the Google Root Program: https://github.com/cabforum/servercert/issues/604

On July 8, 2025, I sent email to google-root-program@google.com, cc'ed
to various interested parties, with subject "Chromium Root programme vs.
clientAuth".  We never heard back. 
    
I'm curious what happened to that email and why it was ignored.  Did it
get stuck in a spam folder?  Have they responded to you, a Google
employee?

Nico
--

v2.46.0 | Report a Bug | By Email | System Status