IETF Logo Mail Archive

[TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey

Stephen Farrell <stephen.farrell@cs.tcd.ie> Wed, 01 April 2026 00:18 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id E638FD472EEB; Tue, 31 Mar 2026 17:18:20 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775002700; bh=ZONvKIpK6nfSlH8T6Su+DZPR2EiCVgqixFDLeaM6/A8=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=G4wzaBJ3qOmgkZDT8IysM7Xn78pIBFcmGlFPaJhRmWBUFFvnnKUQsrJyWor/bTHmN JNY+ZxPytdbZKDLAHncKva3YK8dkNA7Px/ZJY91bDB4S81d17X2me0Sy5DjtD8FUg2 mxyYUlWWJM3fuqRtK8Si4xBCdBsysoRdawVuKe0A=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.tcd.ie
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id govQSnLNRc0s; Tue, 31 Mar 2026 17:18:19 -0700 (PDT)
Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023116.outbound.protection.outlook.com [40.107.159.116]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 7462DD472EDF; Tue, 31 Mar 2026 17:18:19 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sNqpcY/YCJFETd0+TPqvvQKacAIpypX8MlKNB3layt/4v9OqBUBSn7THx3dF1AD6aiq0zXqX9gv7BEy9QPgjOUrFjEm5sBGcisgb8e1sqN7u9ZoCPFb+3mbElqUKWwGEbCkAoZsAwFhMofpFbBkKWTG4/Ve0MtZ/klbsID8Pp0xxS6J9Jz41gvOr7EnmEVHvK1CYQMQCRpPlnpoALLTL4ngw/JHcQVkKCJLPlaJS/zR83a7gru8pTisM1V3pbZ34DJYieoD1o1dICOTu+Rp+j7eDCpwQby4NhPi66VSx25Kr7/65fSC4oKL4oUcWcgi63B8hBxnIWO4kqQdgUYBObA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZONvKIpK6nfSlH8T6Su+DZPR2EiCVgqixFDLeaM6/A8=; b=QaLXN+gqkMM/hGFjfF/F3H8jcczpc0hjuP5uDnSd6ZCN9BdTfjC5zusME4FsuBz3u2PFN0fxo0205QMrhLPdhQp3uAMAqfjd3edf7P3/sT9Gha8QrIbXgK+UW7Apz8mayvJ9681fKuAmutdvhF540amYFZdt0xxACQ4WLXDHdb7Nj/Wf3iz+rxO+W2/Z95KFqG+vYiUe3wGAbCZWiy67ra8bZJBQeM6JpF/m2WwMSSXt7Z8sjxMY9kPhtAQHXpxTAcg13NbtG8UkVRXmkfwh3wLtirCC42DLwrrWyo2n7OLF9MJS6jR38dAUdbrAskNiSsGGXGjI4sUpIeslWMCI7g==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.tcd.ie; dmarc=pass action=none header.from=cs.tcd.ie; dkim=pass header.d=cs.tcd.ie; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.tcd.ie; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZONvKIpK6nfSlH8T6Su+DZPR2EiCVgqixFDLeaM6/A8=; b=VYY/9FUhyG6SSAANYkGZtfD0f1riNGTGbzbWCY4BfLi5EKet+tzVtOSnfrrN/XqAI32n028iHzgl1g/yv9QEmp0APDo78XuIemMDGFzoW9YcKLkFepUn9eeh4Q1TFGFwrcL1HW0WKHIH5aMEJrtOSAKpIgJCM8JWrPbGWQTvafUDHfoq0+xdzV6JXykURPlmFG2D+czQ8XYaDB4d9sh8nI6FcgRl4aIo4GhHusSqYPYdfQ7qmlOSS1ys009O6ooKTIGd2vmEBG/W8EXYJyp8AvMoTVgmu4Kjx2IgcYY0pVCZ7c2aLGWxnPtYZg3tUPxckWV532ti6nRzNxu5Z3GejA==
Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.tcd.ie;
Received: from PA3PR02MB11163.eurprd02.prod.outlook.com (2603:10a6:102:4b4::19) by AS8PR02MB9020.eurprd02.prod.outlook.com (2603:10a6:20b:5ba::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.15; Wed, 1 Apr 2026 00:18:06 +0000
Received: from PA3PR02MB11163.eurprd02.prod.outlook.com ([fe80::71cc:8d7f:5cb5:3772]) by PA3PR02MB11163.eurprd02.prod.outlook.com ([fe80::71cc:8d7f:5cb5:3772%4]) with mapi id 15.20.9769.014; Wed, 1 Apr 2026 00:18:06 +0000
Message-ID: <2ee786e3-14da-4b0f-a3d1-c2780b424f4b@cs.tcd.ie>
Date: Wed, 01 Apr 2026 01:18:04 +0100
User-Agent: Mozilla Thunderbird
To: David Adrian <davadria@umich.edu>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com>
Content-Language: en-US
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Autocrypt: addr=stephen.farrell@cs.tcd.ie; keydata= xjMEY9GzphYJKwYBBAHaRw8BAQdAo6JvjmSbxHdQWPZdvciQYsHhM1NxQBU398Mmimoy4p7N M1N0ZXBoZW4gRmFycmVsbCAoMjU1MTkpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPsKQ BBMWCAA4FiEEMG54R8tZDyZFrDOn5Njp+ZeoM90FAmPRs6YCGwMFCwkIBwIGFQoJCAsCBBYC AwECHgECF4AACgkQ5Njp+ZeoM93bogEA25ElRyX0wwg+kGEN1AoL60MoZfvQZ/VtmXY6IC5j +csBAIBpkL5ySuzJK2zLNZn9qQGht8IaUcA7cvDcLvS2uHUEzjgEY9GzphIKKwYBBAGXVQEF AQEHQILCPWOwW36e8D3pY8GmvvtItIT+A5uV80ist+WokVsQAwEIB8J4BBgWCAAgFiEEMG54 R8tZDyZFrDOn5Njp+ZeoM90FAmPRs6YCGwwACgkQ5Njp+ZeoM92bcAEA8R+8cpqRUIS+SoAN iO05xE6O/wEx8/e88BqzAYki3SoBAOQdwiPX+MQrAxkWD8xxOsdMOAtxYKpkD1n8aPJUw6QJ
In-Reply-To: <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------RO0QUIa5y77G6vzgFmxvlSy4"
X-ClientProxiedBy: DB3PR06CA0022.eurprd06.prod.outlook.com (2603:10a6:8:1::35) To PA3PR02MB11163.eurprd02.prod.outlook.com (2603:10a6:102:4b4::19)
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: PA3PR02MB11163:EE_|AS8PR02MB9020:EE_
X-MS-Office365-Filtering-Correlation-Id: 6c934366-25f7-4a86-cbfa-08de8f842568
X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True
X-TCD-Routed-via-EOP: Routed via EOP
X-TCD-ROUTED: Passed-Transport-Routing-Rules
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|786006|366016|19092799006|10070799003|1800799024|22082099003|18002099003|56012099003;
X-Microsoft-Antispam-Message-Info: +B6VUtvh3JBPNYnI48DZs4/D9L7Hz1G2Av7Nzkxi0Tp54/xf8s1V2lxGUVU8CHuVISy7pwazgRGNRAuACALGiGnlS/FOn5j5x+vsM1XKCirxW+ofdnValthlDjnRWZ7oSPJpm0ZXBjkSuwU/9FXep0VPthsCvTte0koGyt5c6wDVmOzmq1YOaKCHVTlwCEMvf64oy6KZ167lC8HxvyZ4HzllJeSlxEKFkmKV0A4jbq9biW6ZRoLhxCUrwe8zNW1YcPfMpFix+V3+vCb7dqh57I0QGDZGdhOQnv244idRJo38LA2WO3mod3LCIJODMd0P1m4qtgMm/g5bwqu7tqgZ3vrPwBv4PgpC6taPQIynk3cG0lfJGIthRQSV6I8GXy0tFeVlHa0zJLvDvlLk2EMDFSCPIiQHYOzGBVgrl5/BihJHzzToZDbROmDfH+gePuBHK6CHbe2Ss4x4DDLUZIBa+iYTPRGMo3lskNjIHOjRrD6ztFBMcxnmTASQMgvqjc335w6c81zMBbwyX3kQ8PsXiPJ0didkIe78ae0MC8NL73qrIm3qbYmjJJUaXwzJU3dVBHQ4OpjrDxGTt3Cr1Bl2FKKdMICnYSu0HyJYP+/GaYfLCRJ4jskxgmSzkUmtJM5uIlZ7ervTDCJpTLXfEC30VQN2zN2t+CqvgKy3cZ3JIQt7oIZP61ptc5FIudRJfLolSlLW+6HC2+6pcNmWGRLAw0ZlQfD67EI/27Rux8MgG4Y=
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PA3PR02MB11163.eurprd02.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(786006)(366016)(19092799006)(10070799003)(1800799024)(22082099003)(18002099003)(56012099003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2
X-MS-Exchange-AntiSpam-MessageData-0: ZcBpAQfpppyy2lRbuNI2r6/7qz1sVSTvrfB74JSVjUaIVVmbjKUjuT0jFgSc5MGBU7aRuhuTUzPB6YCVDJFyULlLdp6LKWrjbpj5ulPjK1vakueeOCEH6B1vTR0b/hCwwexPOZ4EoAPEapIApKmPP9TIsYgCjClzlbC5fF7XvC/5AL9YOSiUCguY+hOH2EaC9AMofwwZXJH4veSs5CNnkgKY6NKXSzvUE45DXQiOVH28AszEnc3qgYDnCyugy/Egl2OwKF89xwaBd/Vv3HnKeFWcn4I0+xGrJlg+MHNrvLsRh3UNR9f1GJePMNMNyiqGcOnysUwRvFVaqkRHIenTUpp3JxmGzhxBfVV4ke8EbeN+L1rmpZJ4T1pSiVW1Q7cXwNOw2pYQ9G8slDNcEFx1skureHXdRhUhaFBNrzMruMoF16u4gVYUkC+QOWx7ZPK9P3dqTwDYn4TzFEExK6HqyaaI7sgOuLkGkwNxvEjc0HZT+5UAXpWC+LuqRuFuUm9nWTXS2MAbSLmBXd2rI3HuCKuVQHrvGM0zYcy74Bb9UJ4HErZ9MPdVJTd23mWmaTcrh2p02Ltt95BusJli6S0SivDeYHuXJBKSzVATXnroWT4v7b15E1XKish3wLBgvpDcXIfSA3kXfN13TN2mPMw/fNhENGM6YAwBFDx+rfIfXEnbdEhuo9/Seu6uqPMEWs3PRI5bLnYGUIHQm85xu9O/y7HbHO+7DK86VBTgpnkGxqYXRyP9mwdYE3vGKj/kXgblo8yBX+YAyY9jO71cTyjgsFYr7zeKFzBTB6m1IE7jJg5Tu73TiwUuhkALqO1GYeAhPrMWDAAkHMgapeZ2rqxpyUtZtIQAthOGvZd4AXpqn/fZUjNm1xGgzqsvvFRqcswQSunploDKOhFba0K6Mq7Kx0CrWn5V5Kj6/y7HR4eFBuThXnQR9t2kTk+eilKc32GNeF4mtJ0D+4YcqGGaxcpTsdu2QViH94jjSwnlXxNuKt8NRHodq27NaMUxGnjy7lx2FyAlE3f426E5dpk7t0hzLq3sCda89GxEovWf7UFTGbffXGWTfTiYntdds7/kuX5LtkhEXIZCanevdyS8WJGlwdKIUBhhwPyPCQtwFAhMnG7GLtMIETTFPcp8gQIpNe4UrsP7dg3Aba6FySPnpr2BkagBu7oPKVgI8Z83gA+5vsNRaqLth+UUUiDFd1iqyJ7ADBFyTziRNMvlV12jHoyNcwzr5RpLbt64eVbo7Zy1ZKbnHTboqvpmdvgZrZN9BJXaCICbBv1ceD8tG0J34n69zQRliSWVMMx4PoL9Fh5ZuadUyLagiKG8hWxidNqb6RDar04gVIsqbnwDtFab0mbn4w8DbFCKLYu+7MCHs+GqnPnOFmY7kpcLsNL/a52wEdkf6G0wZtg6xDLdbbk5JTHWu9rdI1Z7eHD4PgdL16CE/8n3QYxLI5dVIyyi5nisWhUmrYsH9fIyuyhDk7wXwRtQaCNvanzZC6Zp5aIoaQWUAxNUmLvDJ89HR4ATvnkpy9FFVISj+LVOv4dN0zVCbKI7rFcs4LyWCsacG8bPTiB3/onh90A5hnwrAUrsOPvk4hPqfoS8yToYNwi79/9RWNpg0lRpOgLgZZcUyXybqeQHxoWsdt6fNeJgjEt2BqiT3tjf+HsMI/OBTiWAZGe9MgKAP43bXthaUOBTbf6f3vGJ7K/qxPgpTEXtrla/nXrP0L1zGV/09CRP3jIDu32aTt3ZRLLdxOAGoIiyxMfkW+LSiiql0SGsgE2vUjdtxl+OdW0Bme57DLHx
X-MS-Exchange-AntiSpam-MessageData-1: md1OVDJuxR4y5Q==
X-OriginatorOrg: cs.tcd.ie
X-MS-Exchange-CrossTenant-Network-Message-Id: 6c934366-25f7-4a86-cbfa-08de8f842568
X-MS-Exchange-CrossTenant-AuthSource: PA3PR02MB11163.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Apr 2026 00:18:06.2749 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: d595be8d-b306-45f4-8064-9e5b82fbe52b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: LuFQcqQVIR9V9yPer2wVRGe1HLkRtMKJikKMSDka31VRHfLJwPc8QBEAejDD07NM
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR02MB9020
Message-ID-Hash: ECPESENOPSIQRSERWS5CTEDAY3BPN7WO
X-Message-ID-Hash: ECPESENOPSIQRSERWS5CTEDAY3BPN7WO
X-MailFrom: stephen.farrell@cs.tcd.ie
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [lamps] Re: Re: Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4yIntvFWI7vBpwI9p8H2OvHZOa4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Hiya,

On 01/04/2026 01:00, David Adrian wrote:
> Speaking for the Chrome Root Program [1], the policy does not introduce a
> blanket prohibition on all CAs from issuing TLS certificates containing
> both clientAuth and serverAuth EKUs. Rather, after March 15, 2027, the
> Chrome Root Store will, by default, only include anchors representing
> serverAuth-only hierarchies.

I'm only being curious here, so don't feel a need to answer, but
I wonder, if you applied this policy today, can you say how many
anchors would still be included and how many would be excluded?

An equally good answer might say how many you predict would still
be included vs. excluded in March 2027, though of course that'd
require guessing what CAs will do in the meantime.

Thanks,
S.

v2.46.0 | Report a Bug | By Email | System Status