IETF Logo Mail Archive

[TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey

Phillip Hallam-Baker <phill@hallambaker.com> Wed, 01 April 2026 12:50 UTC

Return-Path: <hallam@gmail.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 7C877D4C40B5 for <tls@mail2.ietf.org>; Wed, 1 Apr 2026 05:50:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775047851; bh=Ohe+BKb+Bj+jCnWBJYhrjOEWAnrHFH8ufkGpAsBIM44=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=OanKhLg+i5dLij/2MLlSUkD5CnqcuXwo5c3yHNHUG8miAQ3b1yYtyRHSz0uu2iMIx 8UhWVOv58LeUgMptmZMw0pV8hUEXVS30+ZLR0854n/xAGw0u/zwqsV4Vm+TlhiU1z3 LMiMlFwS6ousYYjhurlmoBfW2z46Mno89itfsmJU=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.892
X-Spam-Level:
X-Spam-Status: No, score=-1.892 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.001, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bS0H7zrxYpKW for <tls@mail2.ietf.org>; Wed, 1 Apr 2026 05:50:50 -0700 (PDT)
Received: from mail-qt1-f179.google.com (mail-qt1-f179.google.com [209.85.160.179]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 46A01D4C4099 for <tls@ietf.org>; Wed, 1 Apr 2026 05:50:50 -0700 (PDT)
Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-50b4001af28so71382861cf.1 for <tls@ietf.org>; Wed, 01 Apr 2026 05:50:50 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1775047844; cv=none; d=google.com; s=arc-20240605; b=KatXtzq3aHihmV/LkpuZ8dkUUY2EpIfMLC2J4FAfexgYJRksZhdAK6BWlLldscvuCS T4fUXv5CAttzlvzyy2/+Zl5Pgqe15ioRXfTyDaVpfiER1kKTu/w0WNaSnBQCTVzQ22CD 7pXyWri4zQMqOH2pDcBj/NhmdBf7xbWu0UBPXVQQ8bmaJ1u88DvEQzDGIMq9I9otqZxY 7P63/aVSrPkwIhx9guCF8oflGDP+pAxPQY2liiV6rTPNCVYKsTE6+HIfQHlsF29yBeTS +sXlqT+ee8ce1nwcAAijM+pnn0s/qmOGETmgaKKuyAg+4CLEmLjw4ut7ML+UEGpvgyrb 7Iig==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version; bh=Ohe+BKb+Bj+jCnWBJYhrjOEWAnrHFH8ufkGpAsBIM44=; fh=2J+x9shVoBpyPvIp0YDWNM9p8hEY88oRyQudDBJNxCo=; b=Yju8MW5bpp+1GhnpYjblyII093YB2tLBlMewOvVpEwP/clWy2Y5xHNoT06Op10yNyZ 5MEpJ2kzekONxD8r2D94YDQTTQnelivLfwYFELDFPUXfLuX+o9qRakSEi3zmRQxURbhP Rd/a5zu2HCTtqLWRFCAPwL1ONTT2RMt4wwdQLjTGCsZ0GN0DhsuL1dZmvvpuWjJG/XXu 9T4aDwTogwvRYP6SnJYcdzTaGZNzvw4kAKAt56+1n2iNe5NMY0rgta3VUKBTmKzIVyVT gnwbHvoUV8mu8ok1kcUxsFYZo2bzG/LD3r9zsi/XgRLizMqbOkzNCOuqiWwbzKPzqGTF rahQ==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775047844; x=1775652644; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Ohe+BKb+Bj+jCnWBJYhrjOEWAnrHFH8ufkGpAsBIM44=; b=N8QXGYlmtLc1jM3kkUQieXUdXaR+H5Ldj8K0PZ7cF7oOMBq9xxttG8i3bOJ7GmZbZo xUwG9nmpDsaOrHlf1v/ATVuARsKy3Tye4u8tqCjyMf+TckUU6tSbC0967/Fd8F8nfYjx TYi9HqT89fn633BmqZV0btXa818OiDgVq/kISo4BjGvnnZngOGO3S2drcOgZ6N5POHt5 jOsOdJK+TK24MEp/u3JkEwpCBHOBvi1pKMCIk3EWk7v+Kqov0Jzy+/JEtqtsx3OB0Bau kBIPNYmyI4Ln2XPGXek5d39ukar/QOPG47Q3CBR4LsHQVWhugXRyoQz1/T40Jis/o0/p x1SQ==
X-Forwarded-Encrypted: i=1; AJvYcCVQV6zlJxMmTQ686k48bcbDLoCJjqI73VSBkQOwJUWfycZUfA9yEeUCZwdsvizyz6jV/lU=@ietf.org
X-Gm-Message-State: AOJu0YwPTKbccBwx/gUqqu03Nm7xcTlYdFJVADX2vPVyt1Ses/a9JUiX +FbXMQF0TZvXDn2H9Twym+IjgTr/KEG0tpSCoJejZzY9srsRBm/b/eAtF+x0kNVx2hVe7T62TaV sU7MRWgygLwDz3cN51fLq+bhLjatJ/RU=
X-Gm-Gg: ATEYQzzQWvZZmFhDJBavbFShnnwr/JTpQ4Q6FLRPqeulxZbN1OzOl6llUdc3yyn6D7Z 7H0czknvd+oqgVXgoJ8ngkOfiixcVbhabw7Xi0Rhs/mdUjXQ9/og/IDQrW+jTxbmPBSD2PPzVxR izPXOiQRYfzUauKzz204XbHFHRGi4PsiXWPpXeYUeypRsu5U+QIoomx9ai4SVS1O8LPpI6m7FR2 RT8u1ZhHVOMWsV1UMKmrJU+sqHFQfGeGEInvnVBzUE2umSvYe4ExJZl7jGM8LhvYZsFK6vwFjbQ Hpgd1Jz770q6gUnJvhCg+yGX+SHeIHC5uDHi5g00MsUzVZpSw0pEQIyoqNp6lqw=
X-Received: by 2002:ac8:5e07:0:b0:50b:4dc9:3488 with SMTP id d75a77b69052e-50d3bccd919mr45175941cf.45.1775047843657; Wed, 01 Apr 2026 05:50:43 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <CAMm+LwiGABsBzMD4v-DrPqyAbnAT4Z0Mp6Ee_Az0BSu0G7nZEA@mail.gmail.com> <CACf5n7_60uGAU6F4qOedZL16e-8J13a7k2vLG3qkj6CtvgTofg@mail.gmail.com>
In-Reply-To: <CACf5n7_60uGAU6F4qOedZL16e-8J13a7k2vLG3qkj6CtvgTofg@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
Date: Wed, 01 Apr 2026 08:50:31 -0400
X-Gm-Features: AQROBzBCck5UckKh-MQU1fa-Si2tUpkUfVKJNS170-en-DFKrNjUGtP3aYNiEJA
Message-ID: <CAMm+Lwiwp4PzPGG7WjL5CK+Ypv2aaaHn8x7rmHbZhNBb04+vhA@mail.gmail.com>
To: David Adrian <davadria@umich.edu>
Content-Type: multipart/alternative; boundary="0000000000002e39dc064e65881a"
Message-ID-Hash: GKVVU3TTGSBHFX4R634UYTPJ2TKK5AAD
X-Message-ID-Hash: GKVVU3TTGSBHFX4R634UYTPJ2TKK5AAD
X-MailFrom: hallam@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4UoetNbItsR71kmGwPuXZdNShBQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

On Tue, Mar 31, 2026 at 11:40 PM David Adrian <davadria@umich.edu> wrote:

> > I would have rather more sympathy for the position of the browser
> providers in 2018 if they had not been so intractably opposed to adding
> support for SHA-2 back when I was pushing for that in 2002.
>
> I'll be sure to let my 4th grade self know that the Chrome Root Program
> made a bad decision in 2002, six years before Chrome was released.
>

The issue was brought up many times between 2002 and the point where we
suddenly received an edict.

My general point here is that your company is in the habit of treating the
rest of the industry as something to be ignored until you decide something
must happen in which case you make unilateral demands and rely on your
monopoly status to enforce them.

v2.46.0 | Report a Bug | By Email | System Status