IETF Logo Mail Archive

[TLS] Re: TLS Client Certificates; a survey

Peter Gutmann <pgut001@cs.auckland.ac.nz> Tue, 31 March 2026 09:21 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 02EAAD3F8EA7; Tue, 31 Mar 2026 02:21:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1774948869; bh=edblQ8dAfi7XLyZYFBdB5iQbAbVoDl/9vFZfeWJaRX8=; h=From:To:Subject:Date:References:In-Reply-To; b=gFwTq1PGXkQttfGb1HPJpx/AVWTlqcHymZ0BfWZmVx3qyvDLSUoIX2EyazpXgJUXt foeJ+u2cw6FvgMMr9Q7mmiHTLVZvlpvh/OcBMkqpcjOjZ2yQA1dr3ImgBOU9kHH799 Ofxp10718Sl46WG6Q93WJc6H9hFu9h4Y4pgj+v88=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mo9aRrd2I2vU; Tue, 31 Mar 2026 02:21:04 -0700 (PDT)
Received: from MEUPR01CU001.outbound.protection.outlook.com (mail-australiasoutheastazon11020072.outbound.protection.outlook.com [52.101.152.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id AF6DCD3F8E96; Tue, 31 Mar 2026 02:21:04 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=F96gl4zFoHp5MOUxbdNzV3yOejizkiLZqgDLg33F2WmlAX+nWeuunqjyHdR/czVTwJTg++y8NaO/2gH444AI5S3twxtEge67SGMLirYAMccRS/vsAzo9C3OxIe7yKDPJOYDQKx1hbjmpxhTTcqbnKRAryQuPUTlXa4dq6ufM6KJL28x15f6xniZ/FnCZyhUbs4U3ou3keoE6S/cOjQ7e2bjJks7cqSImGKojKo7L/Yy3pWKJ52VferGjwfLzd01zmpU5/xRbaGxThWMokS9r8uu8EK6DSgKS6hzY7eH2crbuOyoj0zarfysnRi4MU999NlhoZ+o5xupnK7lSoKsKlA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=edblQ8dAfi7XLyZYFBdB5iQbAbVoDl/9vFZfeWJaRX8=; b=lOqWOBtvMv0MG4Uwznt2zgwOmWZs6/gQQ/BNTyLdqg8RYzn3viZbJoPSucT0/w4PEflvoV5q44fSn0P0bkpF/UAWGF8ATozVO22OIn5WYYCzmFHGfs0mJoicRzpN2N4KWtFZEnsp6+F9BebIVsKoic4yoCM4lFEaL4Hg85Q1vlB5FN5acyRnYYiASIhNB8nEkdGaCCvTWHF6GmG9JnL91Mn+O6thS2cEeiP2xFyqxSVi0pRfqd9LxO5dEwjR9fsieiyM+PcgKlepZ0XhnpdpDoackyvn2ZojVyBXwqS76WqKdmJpoO4GdppwjToez2XTRhe+aiUxyBpHiTQBnWSBig==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=edblQ8dAfi7XLyZYFBdB5iQbAbVoDl/9vFZfeWJaRX8=; b=CjigyTvNr8sAEq7LRzk+jsHivOsVf+ZU6MXXhjt1099k5TiDKfoc/Gv/9RC6bSBEkZ8vW+nfpClhuPCBx8rQxXdeBlK5Rt7oEsaovAdCZ4+7IKeCdTbjBSfSRMsuO2cGFqc9ojb3vyooJx+tjsSFn4bSR/xiLDBZzI1VX4SGYetw0zHcWaU1c1HPmetH39s6wJsvasN4gtA734zjm8qbG44Oxk0zK5k8gwEx2lJIqUQOL7JOD77pjHipc4EXQjX5tVWsCeIm5pntuXX6lYmtO+oqgbywUf0IazxoDu2UX2R4/vJLI4XwE1eaWB+DhTZ87JkesWAFf4czfC+2hZ6rVQ==
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com (2603:10c6:201:38::9) by ME5PR01MB10332.ausprd01.prod.outlook.com (2603:10c6:220:253::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.28; Tue, 31 Mar 2026 09:20:53 +0000
Received: from MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064]) by MEAPR01MB3654.ausprd01.prod.outlook.com ([fe80::e2ae:955b:18b7:3064%5]) with mapi id 15.20.9745.027; Tue, 31 Mar 2026 09:20:52 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
Thread-Topic: TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFB7XHjyHhgADeqYI=
Date: Tue, 31 Mar 2026 09:20:52 +0000
Message-ID: <MEAPR01MB3654A3DEDC6A5E69B64B7A65EE53A@MEAPR01MB3654.ausprd01.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com>
In-Reply-To: <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MEAPR01MB3654:EE_|ME5PR01MB10332:EE_
x-ms-office365-filtering-correlation-id: c88e964f-b88b-45e8-298e-08de8f06ce61
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|786006|376014|366016|10070799003|1800799024|38070700021|18002099003|22082099003|56012099003;
x-microsoft-antispam-message-info: Xfw9NbbjZ+aO0E3+blGwpQ2PZKF82CkbFOvS7/IEYMWSz+9P7/BRJ0LJe7XunxIW3OP5FARmh1v3MZPbi3qMAIJUOQVWo4L1KcgrrOFhTBy+3LiUNZamLXjpmOLJkAWuqAJmtabmwrEITp3sg66ykDoN5avTLPWLuf+fYnF7cXLHGJj4yofGW9183C/HiyvvrcfGuQYGMu8uBmq3bpJbYILpbNhrXMKiDvZ59w0Ft7Iy3YLGh9d3BONoUY8n4mTF1RdY5svy6HGKJo05ohDVl00HlVDN+q6gvOTKHM1u1nhGYyqhio4a+aa+cgK95MusAKMiy5edeuyvDpL3+tnMgQxA+gQWy70yjDpQnEIT8TYiTgs5arUEXuZU/ERM1L6s/oAPb8p+l9vu5ZK+/wVMmAYng3owCYy4LRw3OM2oLA7frvrd/02FOKrqr4R2QBgvv2AXPkOQSDAKoALICspsxJIWr5LI/61d3BvwCFmcOkAjC0B+StJ93Zyh1uLX5i2oiFLGot8Ol7m5UhkKgOLEHEiZzqgEURPT1WiIRjKGMQcq+0ZgolJbmzBLys5rT6UDiQ21xwzVnhlkvCAEdma31ut4w159t8oTX54R6gq82xohwD2dSJeXpNAMHbZSB9T8dlaxCf8HT/aGK1PL3J9rVQGx1ccAh+VOsswFo0hQ+jG/okuoE6waVN1QZT13YdyPuIkSrY+pt7lTSLwVKOeVpBxvpPPwi68/crjdu45WzBEVYdchjAqf9ja7CuX9hEdgwCyO26OqrRjE0nIp/vHXZFl9+/y1jbc4h2x6p0DQkMc=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MEAPR01MB3654.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(786006)(376014)(366016)(10070799003)(1800799024)(38070700021)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: x05swGtyrseCym3M5vSGFdSCD4gSmtMU2qcrUSnrEwUoTb8/+PfGjsJXryks79Xc664bX+awu35l4A+wIEr+MzcMAYZ/MwtnjIRmPzYAnvF1l1GICXbWFlkbd8iwg54WSul1iLdW6OgM9ULDNw8WDQIYpLB/X93mjb/ramjaRNtt69/SGEoR0q4IWmXkvDuOpJaBsuBlu+P+NBeN5J0+VUVQp+eHDmFMEq7POLvMDivA1x3Xodus7h+mRCLl2BOCe79hm30mhubYgCuEu1lGan5xE2quuaih9BVbgsM7onQGu6tj8bqD77JE6ZIc7dLgIOwD9Ck2qbPKgayQdMsi6p4C4vaKJT4P63rnHeIwG+mxLNGmYfG11YimBd3pXzuCJEzxR1J8Q0k/L3rxjBn8VnQq08bYDUNWgGvmywu0goOhYW0mK35ZYbKa+WX3qaoncbJNimw3fmVb7Xvld3Ps1boLCDgXlEJJuQkyZ05O73d+Z/W/7cQTnoptFEjY07En9IkMwKoJcZiQ2SthdCa75I6rRZzs7wDiBEQoMELWRqIRd5uWUPaZ96VM6qYWGE5BPHN6wAF/TmP5PY1smOsqJZDM5FzUzEtE5LP6398qL8WsjwnYJccIvwoUVSSyy3tnIH7AsXztrFkxDaDdzCSORrt45BuIyV4dq1tXrK/GTLbPUN+uu/l8AEB9YNueYbPh6aeaVEEl4i1zTbvV5BsotC6KJ3BMis2MCvM/956XBWjRgz5gQGWvMYFrAhpCGbHQJREcj0E2mOjL5ljvgZmE55zwvGzqgkJZPd2zPb/gzeFD2ADtKzFeMNhp4EPGTz8yfbgVPQol/ahYGKr1VZhQmYo/5bTk7Rc8htlStg1HvLHushm7kWdqnDtrt48MTEeoW3M3P+uBg5nssT4hGQFVPMTKgCc9kr4wTUfU8OPaKHNgYFj9f4nnSPFXgmSsNbzn225LgGgFZSqLlzITFEzj9e7hYwwLEC2rQJpLx4gl1PlMyagWZuy1YVZGW4QjD3GAuLtpih7+ij5gVy/Be2z1EMu+rF4tMMapnZU0UgbfWxLBaTYdau0cXDB5mQoRWEDfHGKNRQ42mMp+BDSKsR5fCzTL8wvUGuuRD2swI0VTWTjQNBxSUpXv0gQ/e4DFHQYNp+R7aLx+iieXr5DdQzbykOfW3s4A2hKiLFQXCX/HEn4yCd7CkzSFu2qwooP1yaMVzu5A6E3s/Cmv7yjwsO+ySfjUtpRuB7ipSQSD/avxn8xWwpmTfhXSMyn+gxLzRVtZG1SV8dM/l8KjDbgeMtAVILy9tgQW4IadTqB5cpLPXJd9yulhZ6bjF6P+BaAfIpHPOnBZQBvqe/uQVjEguNPaR1HNTScwW+Ew3CPTaJru9bAy+r5AJpAtaLEzWL9v129XMlGczWiAGFKcevLAOfBwuOfETzdUPEwEcE+vJcRLAvI4zX3FnmT70axWfE8kyoeaNgq0V0x2jBW7WtkmZnxJp1gLnjWnL3Iwkbr0xYyc+V+Vag9ONij9DvxZdaNZ+u99K5FIQfgNWWnbN/AWuC30tt8IWnRP87aN3FXQEFqWIAmr0atOpZajQvbRtlOKBollHGQXXOwUzSbaeLjzpl04mDO1ASwQcarCtg0k8DqIN2cbKxjTP8c/feQAXAWurBxwo0Os2vpF1ZK0LpCjL6RBT6j5JL749p2hI7OdKE1reMYkIdO0I4pTNwjiGl00a8Dg/i4RtY1wXtd7EG6g46VC9YjbJRprrzCkcrWK7zQzpusvY1i5LvnBxQXf1Uj6QbtuzZlNdQQp
x-ms-exchange-antispam-messagedata-1: P4WrCdaf3xFF7A==
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MEAPR01MB3654.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c88e964f-b88b-45e8-298e-08de8f06ce61
X-MS-Exchange-CrossTenant-originalarrivaltime: 31 Mar 2026 09:20:52.8087 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 2csLKZOaN3hBkIEmuEdQo13JPHIjeAxomDMT42rSGJiPc2NyO7+xxcQLZ7kbALNu88g17zcfBtyfpRjymcWybl0Cdc0/QpiFxTdgV/Ns0g4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: ME5PR01MB10332
Message-ID-Hash: F2VOUMUBFS2VFQA5LRRJPW3Z56UKDJBA
X-Message-ID-Hash: F2VOUMUBFS2VFQA5LRRJPW3Z56UKDJBA
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/6AetVCE3-JJwA7LnkO1sD7nFdxo>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org> writes:

>The overwhelming response (strong consensus) — both posted and via private
>replies — is that applications will just switch to TLS-Server-Auth identities
>for the client side.

Or, to paraphrase a very old quote, "the Internet interprets one company's
attempt to impose their will on it as damage and routes around it".

Peter.

v2.46.0 | Report a Bug | By Email | System Status