IETF Logo Mail Archive

[TLS] Re: [lamps] [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey

Andrei Popov <Andrei.Popov@microsoft.com> Thu, 02 April 2026 22:29 UTC

Return-Path: <Andrei.Popov@microsoft.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 05861D5CAB53; Thu, 2 Apr 2026 15:29:32 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1775168972; bh=0wdWoBbO8nKOJEEdMDvudK25F37EhAuWnWM8BjD2nJg=; h=From:To:CC:Subject:Date:References:In-Reply-To; b=DVs23F0iivpnavRbyqY9D/QGd7AZOt8v54LJx5XwjXLU4lZCYhNgBD9dAGKsy0TEL XsWHXhJ5bt8xq53FvxJq/tuhP2wCgE7O4hZh5CvZ+joDyNFDHDH6bTIvCt+nw6MWH5 FEU2iQ7M8DghlBZeODgiJFo82SfoHEDMkbDaWksU=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gcfdRo02a6p2; Thu, 2 Apr 2026 15:29:31 -0700 (PDT)
Received: from DM1PR04CU001.outbound.protection.outlook.com (mail-centralusazon11020101.outbound.protection.outlook.com [52.101.61.101]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id F2977D5CA287; Thu, 2 Apr 2026 15:28:31 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=hjFZU/tvjLUYGJeSkJIpZvJrfEl5mfb7ipvgczc/dv26KdLKDGPeUNMz1WkITDV1niqXh8IXdPqLqmQ06zwM0PnvK1sv5gH7Ug+ZbQMA39BcgAwNcyOWfvCCl7kaSfrBRx3L5CzzjWxcrYS89bue2NRm8JHXJ9+MhO8DOhVofNja74ki0jlvb003hbvYgDtBUV83YUuBpEZM+zK06+cSbl1y7M974LmWmsC6V5uijglgiKf9e/F8JHXxu7SB5gvD7YhH5iI4q1tkouB/2iSGI9z12K5g87onhzexST4B7QqAevNC1UfKy5jgKnroUnNLVDBYTv8R+tDkloFhQ1+Y4Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0wdWoBbO8nKOJEEdMDvudK25F37EhAuWnWM8BjD2nJg=; b=fMoirTwGDFiG+NSLlSYigS37THu9nW0BFVIj0I8kFkg/fm5epvRchCoCYRECLp1SzV8tIoPR78FZHkYp/2ud/A4VAg3qgP02eQ4dUKG4ZXvT94nYAp4zUxaIUj7bgHZzPUjrHurHOitMvHEXmk+84/09HVRE3Rg73/PxO4yOSKfZlOIz16jcwXwqqxWaTXZJ8bjpJ2lvtuEff12rynLslHufn/x8SXGonwNlvrVc3GrFOSGKwHH9tTwa8EnJe4W0hRvEl1Fy/YRs3009M4n/L2W3D3nE5ZY3bGuWEYNqiwu1D2H+7ptWdH1iCFQ/1vCnlPwLwG5ZQvpkZkdCJnTSIg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0wdWoBbO8nKOJEEdMDvudK25F37EhAuWnWM8BjD2nJg=; b=HteWUzU/DeLMBqpVng20AiMAamscLVGp3E1iJjQEwkCs9hxu+KKrllO4hZZS4j0nItaK/a6NupcZjkeWjsgDciRk5fBrf/o89nREuT75zqEpoBkQUSOTt2wxivvM9bk+2qP9eG0lE5UkGBTwSW0kw9n703BGDlmdZOOqyKSJuCo=
Received: from LV0PR21MB6623.namprd21.prod.outlook.com (2603:10b6:408:332::23) by LV2PR21MB6691.namprd21.prod.outlook.com (2603:10b6:408:34c::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9791.6; Thu, 2 Apr 2026 22:28:23 +0000
Received: from LV0PR21MB6623.namprd21.prod.outlook.com ([fe80::f1c5:29c7:254:49c6]) by LV0PR21MB6623.namprd21.prod.outlook.com ([fe80::f1c5:29c7:254:49c6%4]) with mapi id 15.20.9769.014; Thu, 2 Apr 2026 22:28:23 +0000
From: Andrei Popov <Andrei.Popov@microsoft.com>
To: Alan DeKok <alan.dekok=40inkbridge.io@dmarc.ietf.org>
Thread-Topic: [lamps] [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey
Thread-Index: AQHcwuWuOsxYqbjhbE+CE0ANGMqNLrXMV79w
Date: Thu, 02 Apr 2026 22:28:23 +0000
Message-ID: <LV0PR21MB66236460C66455FC56B7DABF8C51A@LV0PR21MB6623.namprd21.prod.outlook.com>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com> <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com> <acrfWoDSHUrYj1if@ubby> <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com> <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com> <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com> <ac15yB5aylmUnjc6@ubby> <MEAPR01MB3654D313ADD0D83693FB21BCEE51A@MEAPR01MB3654.ausprd01.prod.outlook.com> <LV0PR21MB662376236B5243AC549774618C51A@LV0PR21MB6623.namprd21.prod.outlook.com> <F5DAB97E-9D9C-4A5D-A4C8-C15390AB0A2B@inkbridge.io>
In-Reply-To: <F5DAB97E-9D9C-4A5D-A4C8-C15390AB0A2B@inkbridge.io>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=3e1f262f-7029-4109-8c7c-4751d77bc9b0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2026-04-02T22:19:28Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Tag=10, 3, 0, 1;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=microsoft.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LV0PR21MB6623:EE_|LV2PR21MB6691:EE_
x-ms-office365-filtering-correlation-id: 09b9bb52-ea0c-4176-007b-08de910726e0
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|38070700021|22082099003|56012099003|18002099003;
x-microsoft-antispam-message-info: arQYaB+c547Jr6kOdHD5UCEpl55tcHNNblHCAFsiEgjme4EDrGlERJjvm4Q8z5Oa2W3q6fChhF20XeLbVC9XIqykP17qNPDO9JJAgGIZ7hYkFR+dumUNwbEjVteaC4NaeCLpKgt5WpXZ/MNBuwe+wxvLU7ra4zcvEN3fG8VDK8lYBorGYpxHAbDvsvh/lGgfrsvzkrPlFn1CjT8QVmg1ywRdpV1hzSujvaZlc8u+0016ML80X7Z6Zzl0rJHNBr37OR31wlfeZ2FggYfEiTeDRNRK2VbifdjPa2WBvTzyFZMQ2pzW9T/uHbWmqJDBIHyA/iOTzfq1HCmf2YHu/6BK/NYyJp8isxKw+T3YVpV2GlrUBe71W8iEezjjDZYeR6VABNYwQjGpwNEPjx9B0XlOdK26540rahgFarIBxVuNk1MEq98pm1EeBGInmhyCpktaEVHJKCgD9zrPX8uZ0IY/5psw+mnGQlw3GvNobC/2ca06vI+TZwqhxS/69UWe0FhxwpA0e4ZoM09hpxwSGxKz6WFk+r4lhYBKbMxu+qb188ABWF86AMQrpzT+mLNnxKctsVRhO+1EOKjdqygEvXOBumurlNBPu4cLBurHVCiJ+fnPPYzeIC67nl7Mrd+6fvNp1uJUtLEd0yYRU4AVA8ygKRRSnNXRcJJdiBAeYV9Xd0/DE60wTq+ihiSuVrv/Loy0IIL05eS6eFdv0XIWBzw1AN7q9V8DaY0fOyZ4n+ZiBP+ptDHCBRF9tun7Kxp2AaryQ9gIivYgZLfCArGHRdSZhbJrnRHVvcGPLgR9BuZiHT4=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LV0PR21MB6623.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(38070700021)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: c66iH5CfhMPXLygGdC6tfmf4EYqS6ANgxtn/x0ZKdO6IAubC6H41/osZKLDv8ok3+OxhdlEl31LveD+H9/dDSZqfiD/5M1HRMq8WJ3IHqWFH+LbY0cGLW9yNajx9xfmcX2yU8sjTKb1cEabaq5Iyx4ORcrayDTsNCGAtvhRGJbf9Oc8JcqBsU6WheMaqWMw9H+Vn8sq0WJGtKyQ3O/8u+aFRCPECZ7lKqw6EO/Cxt1QoPc19p2LvjEP5ixeSBJUu1lM1SXIK3lI/sML+2MhAVlXc80z+M0ESTIM1ntU3xpxDjuzbISBMgsO322ibi1E4uei6Ej77xwsxFHULuFLpfKraNUnBFWKT1vGhZcaXdhiA2gXa/K6GGmijGPre/CXNvKNHVlTcna2bMxxc3/XgF+o5ywYbzbWPhP05dTQDY+ZoCj8VvvQ1RE0lUmYQwaDResyRfiValbT4nrbiRpQmU38S2pOtGeypR+aKVD0FCEmlmdH8+VJgdmhqWcbjm+vOFKgMOM7hKqZLAw5pObfN7SO5zixKanFdsuNqS9DF/nyr3BsBnWg9CE8XuqtMy25TJ46DAbbS3niT7Lp9SSSag2lSwfdQhY4THxqLAirY2cazfB7+1BFJv1ScQHPOYssLaAevq8Db7saV68klkfrLZWOKMKqdbubbvRbXJbIe/PBuUcaMeFkZCLBvrQKrt/TOL5UoPN4QODdceJfLiFk/kkZKmMTHYavVW2ZHd71xbgU7JIgEbAUN1EiTBwfNyAl3dPB8gofzUjO1NVQvGEKBUZc0RVs3O6PlWk3/0rJox0MkDW4uqiL3AAdA1JkIaDZIahHrAatqOz4EE+gipgHlA1Op6gdDYb8FEUTcKZfx9Va/SA8Iez4lx7qxIJiQ9DIaLrgEvz8Zhg6/M0Izb2Oad+kGQlf8Snoghpk1gk8v79vptwL6qf5WAbN68D7IguVoGolVSQaMk7xQi9yF8im04EGRqWrxd2X6Po+NlRs/XPdXecuw/FN5QLHou+fV9404MklNzGxGo3La+piE2qvC55W4P8LlnawAKrdgflSJCcMBnNkPRuaamWYW3vx63cAIoITA0XOv31R6aLwzlE1ZW0pWC/rXMzMTXGaCiNjiwJH3w71UTT0XAP5l65N8jQ2/t2LuJ7iNuIW+fkZwP2ZV6Y5zC2AeDhyGbOnRH+lTg4SMPOVOz88w4jd3IMhhJvoOAedF8G8lVjJfHNBHfRRTTHcymQCPTlppX/SioNKeWUPaMs/hEy9Mv9MOz1jbw4JCsllWUJqk0a/CABQIdqD4pbeAUQ+EZtId/DUtAbbFPRA/f1eRwK5APLvgJWYOBovH6q+zLVLasNPB1SB7SccTMdFhKlpDxdqKNOYOQ7EhndK2gK6i0Rb2lsjkz9+YAFfhZj2H3ibhORq3c5rsFjh6V4btSFQ9GpYDmxLgQpSPr4/6D8Ylf+SlYBVJ6HHYMLQrtCZ773/5i8wF8hXh8Hm1ftohb4hkHfPgG/wy3xpcNqeaGpJGFzIj7aFSSuCVFKD7jwfyYeuR7g5p4aDCb3A1by3OYrk12FUP/U0c0vqmvdEZAGDOvNzdIodMzYkrltEoOwMVZRtM9Ku/0FZpkomzabg6NKY1o6G1uKyTnMqoHPSK48N8vMNNqA7wjyrZPRjP0VK8npRzYT/l2XplQ2rAsIvxt5yMqZS1TULCZOyMZv38ILaKcLZW9zc1QU7I46GH8wL2HZ+2CnxvyPBjefneIw==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: microsoft.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LV0PR21MB6623.namprd21.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 09b9bb52-ea0c-4176-007b-08de910726e0
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2026 22:28:23.6122 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: jwZouXoGEIX/CqyAA8GMXy54Ia+7srVVJEcf9hY8eGK76tgSdmR4NEoDsCMe6/5FTTfziG9IiYNqrMTYntpesw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV2PR21MB6691
Message-ID-Hash: LA6TYL4W2X4CPK47R2HW6UPTM7AGZAYJ
X-Message-ID-Hash: LA6TYL4W2X4CPK47R2HW6UPTM7AGZAYJ
X-MailFrom: Andrei.Popov@microsoft.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: [lamps] [EXTERNAL] Re: Re: Re: Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/7zdRwf7bDVyuAgroeu2emZ8z8tI>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

> This seems like an opportunity for OS vendors to provide a standard set of APIs to store application-specific roots, and to do application-specific validation.
At least on Windows, all of this exists. Some apps/services get it right, others don't. Easy to just rely on the TRP roots, with detrimental results, as Peter points out.

Regardless, I think EKR's suggestion may be practical, although it's not pretty.

Cheers,

Andrei

-----Original Message-----
From: Alan DeKok <alan.dekok=40inkbridge.io@dmarc.ietf.org> 
Sent: Thursday, April 2, 2026 2:14 PM
To: Andrei Popov <Andrei.Popov@microsoft.com>
Cc: Peter Gutmann <pgut001@cs.auckland.ac.nz>; Nico Williams <nico@cryptonector.com>; David Adrian <davadria@umich.edu>; Mike Ounsworth <ounsworth+ietf@gmail.com>; Salz, Rich <rsalz@akamai.com>; Tls <tls@ietf.org>; spasm@ietf.org
Subject: Re: [lamps] [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client Certificates; a survey

On Apr 2, 2026, at 10:10 AM, Andrei Popov <Andrei.Popov=40microsoft.com@dmarc.ietf.org> wrote:
> 
>> The problem is that, particularly under Windows, it's very easy to get drawn into trusting everything Windows trusts, which means in effect any cert issued by any public CA anywhere.  The example I like to give for this is a developer who inadvertently got access to USG systems with a GoDaddy cert they'd bought for testing, because what was at the other end trusted anything from a CA that Windows trusted.
> 
> Correct, this is the type of issue I've been seeing time and again. App/service developers use default certificate validation in their TLS stack (as they are encouraged to do), which is rooted in the system-wide TRP. And then write custom code that attempts to do some form of additional cert pinning, which is either brittle (resulting in operational fragility) or just broken (resulting in security vulnerabilities).

  This seems like an opportunity for OS vendors to provide a standard set of APIs to store application-specific roots, and to do application-specific validation.

  I suspect that many applications have similar requirements.

  Alan DeKok.

v2.46.0 | Report a Bug | By Email | System Status