IETF Logo Mail Archive

[TLS] Re: [lamps] [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey

David Adrian <davadria@umich.edu> Wed, 01 April 2026 22:31 UTC

Return-Path: <davadria@umich.edu>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id DD23BD527A02 for <tls@mail2.ietf.org>; Wed, 1 Apr 2026 15:31:31 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775082691; bh=yA1aBREDaLUdTCNP2/wCyKmVM6cchUfd27K5g1AJus8=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=Vj8wtVmgaRioJUVLkKRyjqC7UYT5uegIgz1DKUcqvvPIp3qlOWSTk6nOHGPTRAMzi I1psfk4uOULAEX6cAtoqsU3I5wLJ6ZSxqIvNOj92qmCCfJ6UguXPoOFo8aBPxzn7gb M8yeXK/GZgyz+MJrYJMD0R1Edsg/6o31TbTS3qf4=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -4.396
X-Spam-Level:
X-Spam-Status: No, score=-4.396 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=umich.edu
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n1OioW9qT6aI for <tls@mail2.ietf.org>; Wed, 1 Apr 2026 15:31:31 -0700 (PDT)
Received: from gorgon.relay-egress.a.mail.umich.edu (gorgon.relay-egress.a.mail.umich.edu [18.219.209.13]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id C0803D52794A for <tls@ietf.org>; Wed, 1 Apr 2026 15:31:28 -0700 (PDT)
Received: from defiant-glaistig.authn-relay.a.mail.umich.edu (ip-10-0-74-236.us-east-2.compute.internal [10.0.74.236]) by gorgon.relay-egress.a.mail.umich.edu with ESMTPS id 69CD9CB9.37E254E4.7B363C40.672258; Wed, 01 Apr 2026 18:31:21 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umich.edu; s=relay-1; t=1775082681; bh=gkXmRxnCRRV9T0w6IoqaHAMS4tfYHkHbzzTsOs+pnOU=; h=References:In-Reply-To:From:Date:Subject:To:Cc; b=EsagFq2gLkCj8G/xwo1iCc5zvCEkAg+cnidEL7T2QbHAeyM3klvywPwGogUEY006s oMPOK0F2UYmrSDVG822ycxBbKogBdJvx8Pw5JTZmqgX6so5C4nkXrxnY4lzbOX9cRr pk0/f+4A2syR9bFTZ0AcO0K5yIfbr+MjrgfkOAeetsA+5zEN/sc9HwkcvvEd5VcH+R CvMXYJxHWFBCcem2JjLFSD4pKgD2MV0zxiY6V6nufEwQT2GrxABhXdVabsEmZ1RXWc wfAYyKuHRNuJvsLNgTyeGA9TVrBTi4Vi2aJxkprrE8l3J/RBB8G43k9FdE+g8DXvTT XHxf4h/P14bKw==
Authentication-Results: defiant-glaistig.authn-relay.a.mail.umich.edu; iprev=pass policy.iprev=209.85.208.180 (mail-lj1-f180.google.com); auth=pass smtp.auth=davadria
Received: from mail-lj1-f180.google.com (mail-lj1-f180.google.com [209.85.208.180]) by defiant-glaistig.authn-relay.a.mail.umich.edu with ESMTPSA id 69CD9CB9.8DABA53.70C1006E.3729422; Wed, 01 Apr 2026 18:31:21 -0400
Received: by mail-lj1-f180.google.com with SMTP id 38308e7fff4ca-38c26612508so2726291fa.3 for <tls@ietf.org>; Wed, 01 Apr 2026 15:31:21 -0700 (PDT)
X-Forwarded-Encrypted: i=1; AJvYcCVEQuG370g0ao5NRzcnP0SrK3Z/UGREyWZVYZdzzKN87yNxZfIYbBJOFCYWgyMNjLqJ15g=@ietf.org
X-Gm-Message-State: AOJu0Yyn8Gau2D/mgCCb7b5uJWORmOojO7AhOLACyQJqashV6LmaTnvN rYg0tkZXah8lYHs5NfhOUY1MjTKN0kfHWu83sQvVEtKA0YiFU4oNSXtaB5tHZJMQ5NJp/ZFIHfe +KQcCGrGQjNg9pinQQ518IvzFeXanugs=
X-Received: by 2002:a05:651c:b21:b0:38c:4b3a:3331 with SMTP id 38308e7fff4ca-38cc2ef7b8cmr20040741fa.7.1775082679267; Wed, 01 Apr 2026 15:31:19 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <AE27DD88-67C5-43DE-B23E-A2DD84714F36@vigilsec.com> <LV0PR21MB6623C8F4A0644B04F57E93418C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <46F3F73E-45C2-41FA-A951-81BB4770AEC6@inkbridge.io>
In-Reply-To: <46F3F73E-45C2-41FA-A951-81BB4770AEC6@inkbridge.io>
From: David Adrian <davadria@umich.edu>
Date: Wed, 01 Apr 2026 18:31:07 -0400
X-Gmail-Original-Message-ID: <CACf5n7_3Dz1uHqpUw0AgxZSLSVcyx9O96mvyAHGCePvQP1s+Uw@mail.gmail.com>
X-Gm-Features: AQROBzBLTIszQqUTqHhXfeCy5smDHPLs-KUszajJ1xtSj4H_6-PGL1rvLWcMlso
Message-ID: <CACf5n7_3Dz1uHqpUw0AgxZSLSVcyx9O96mvyAHGCePvQP1s+Uw@mail.gmail.com>
To: Alan DeKok <alan.dekok@inkbridge.io>
Content-Type: multipart/alternative; boundary="0000000000008b7917064e6da424"
Message-ID-Hash: H2TG2N6PU2DLBYAHIAZDJMIFGE7RTF6P
X-Message-ID-Hash: H2TG2N6PU2DLBYAHIAZDJMIFGE7RTF6P
X-MailFrom: davadria@umich.edu
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Andrei Popov <Andrei.Popov=40microsoft.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [lamps] [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/5GA-ASslKSOFTMJZeTBZBGf10-U>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

> I assume that *GOOGLE* will stop using *WEB* server certificates for it's
SMTP.
> Or, that the GOOGLE Root program, will stop including "GTS Root R1".

Yes.

On Wed, Apr 1, 2026 at 6:29 PM Alan DeKok <alan.dekok@inkbridge.io> wrote:

> On Apr 1, 2026, at 6:15 PM, Andrei Popov <Andrei.Popov=
> 40microsoft.com@dmarc.ietf.org> wrote:
> >> While this is not the WebPKI, the Internet email system is not a
> private PKI.
> > It is unfortunate that a change intended for the Web scenarios affects
> unrelated use-cases. Perhaps this is where improvement can be made
> (although this seems to be CA/B forum territory).
>
>   Given the current (and past) history, I would suggest that any non-web
> CA standards need to be kept outside of the CA/B forum.
>
>   Alan DeKok.
>
>

v2.46.0 | Report a Bug | By Email | System Status