IETF Logo Mail Archive

[TLS] Re: TLS Client Certificates; a survey

Nico Williams <nico@cryptonector.com> Thu, 26 March 2026 02:42 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 1CC12D18A077; Wed, 25 Mar 2026 19:42:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cryptonector.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q7JcewtnV7zw; Wed, 25 Mar 2026 19:42:21 -0700 (PDT)
Received: from silver.cherry.relay.mailchannels.net (silver.cherry.relay.mailchannels.net [23.83.223.166]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id E3FCDD18A05C; Wed, 25 Mar 2026 19:42:20 -0700 (PDT)
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id AFD47442612; Thu, 26 Mar 2026 02:42:14 +0000 (UTC)
Received: from pdx1-sub0-mail-a255.dreamhost.com (trex-green-9.trex.outbound.svc.cluster.local [100.115.116.28]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 4EA2344268F; Thu, 26 Mar 2026 02:42:14 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1774492934; b=pDvAor/8HvkgCVxZZF26VLgAO3szzXSX7KjTPHBwnEFXWdm9sdGtIFY1l6GjqL8hTU42tC sZXyrNIeP5YUEWT2LuqWKg54lf7GCmq9y25cIybWNCaAadoom/QK1c0/Gotp6SY8a0c+a7 fJSyq/vUEjIDWizXzFp8XZEEIUbXJhN9NWaQjfQktKHq3yTwsfE0WP0l+Mt99DwkzApXZi Cg5DlEbC8QtxZzevf94NUbTl444TOlLRcJz2grvED66DzUOs6ZdnmSe7oxA9n1DZmcuQq8 WbDzCT0lE1aP4S1OWgnpd9r43qgykzly9mhl82AcUtig6F0tQDTJXkNpRSxeVg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1774492934; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references:dkim-signature; bh=4vRh3nu+TuW6Q8clnmBAU57YR0C1GPc4c4eXokSyFA0=; b=3Pl4vNmsBv+irwOiS+GcvgK15wjB639aMt5gKJogxTk3Lpk8J5tIknf9y2b3l50hThdZJ0 ithjcV5QsOgvoxiU0ehzRfQH/VidjpTykOVVg9mUZngSh9h3KBFTQ1nALD0Xg1IxfJKA+P pLEY3xXI9I0TrDjw/DfZEKAUVgGaiJ+/OZEliZao8UHRFZbYRLvTMwwswoa2Pt8b2BAIeJ darOC030Ns0PyKfJWgR0FRdLmHYorcy4rSaEHbiXyI61oFOmtE7NeIz7SxZsRklsOwdxO0 JpS+p8odA5ehCHIWEXmTtnyNO4GDAxI0OD7lwHqBeAKnyvW/fzq1PaLQWlqenQ==
ARC-Authentication-Results: i=1; rspamd-7f98bb5847-dcs5t; auth=pass smtp.auth=dreamhost smtp.mailfrom=nico@cryptonector.com
X-Sender-Id: dreamhost|x-authsender|nico@cryptonector.com
X-MC-Relay: Neutral
X-MailChannels-SenderId: dreamhost|x-authsender|nico@cryptonector.com
X-MailChannels-Auth-Id: dreamhost
X-Wide-Eyed-Bored: 410f161f07a3341e_1774492934552_3704863872
X-MC-Loop-Signature: 1774492934552:492922362
X-MC-Ingress-Time: 1774492934552
Received: from pdx1-sub0-mail-a255.dreamhost.com (sub3.homie.mail.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.115.116.28 (trex/7.1.5); Thu, 26 Mar 2026 02:42:14 +0000
Received: from ubby (unknown [75.81.95.64]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: nico@cryptonector.com) by pdx1-sub0-mail-a255.dreamhost.com (Postfix) with ESMTPSA id 4fh7N558Y2z106w; Wed, 25 Mar 2026 19:42:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptonector.com; s=dreamhost; t=1774492934; bh=4vRh3nu+TuW6Q8clnmBAU57YR0C1GPc4c4eXokSyFA0=; h=Date:From:To:Cc:Subject:Content-Type; b=tCmDVpYno4kW0ofbg9gFuwgiZ9Dw4L6zrXq19hutXGTAElxkVRyoIXfEtvwVK1f2O yG5yVEWHKcrtlTWbbqqnCogXcqMspLA9TJQ/0iNN6qmZhlP6gZ+BnZND03B8/Tt/U/ qbttMilwyhgOI6JFmptGUTR3cB2PIdUgF1c97kgHYsu/URhi1A6xHt2o0U0ryTFMFQ A6pM20MYA0aX2I3MY+iaXGm3x7HBcY7YIN9cUs1TXkNA/b6x83VDzoY3qnQSUcicdY 6MJgGX4fLbn5MYoxR1mxhkerC1e3ZF5C4roAopO7fPn8Q3pAiTxbc5Tk/ugDekrsWX 72EUnir3GV8ZA==
Date: Wed, 25 Mar 2026 21:42:11 -0500
From: Nico Williams <nico@cryptonector.com>
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>
Message-ID: <acSdA5dgEpvgxxtR@ubby>
References: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
Message-ID-Hash: BQMW2KMEXABRD535QM3WX46X7RUC3B5F
X-Message-ID-Hash: BQMW2KMEXABRD535QM3WX46X7RUC3B5F
X-MailFrom: nico@cryptonector.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Re: TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/KhQ9XENleDrwxBbCVOs5VWnMwmk>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

One thought that occurs is that now would be a good time to define more
EKUs.  For example, I don't see one for MTA in the EKU registry:

https://www.iana.org/assignments/smi-numbers/smi-numbers.xhtml#smi-numbers-1.3.6.1.5.5.7.3

Sadly that registry is for a specific OID arc and does not include
extended key purpose OIDs from other arcs.  It might be useful to extend
these registries to allow them to include OIDs from other arcs (though
obviously IANA should only allocate from the one arc).

Even so I can find no EKUs for SMTP, LDAP, IMAP, XMPP, etc.  A bit
surprising.  IMO a number of EKUs should be added.

Nico
--

v2.46.0 | Report a Bug | By Email | System Status