IETF Logo Mail Archive

[TLS] TLS Client Certificates; a survey

"Salz, Rich" <rsalz@akamai.com> Mon, 23 March 2026 14:35 UTC

Return-Path: <rsalz@akamai.com>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 2C84FCFE0884; Mon, 23 Mar 2026 07:35:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.794
X-Spam-Level:
X-Spam-Status: No, score=-2.794 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 85VBwgpODAg0; Mon, 23 Mar 2026 07:35:22 -0700 (PDT)
Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [67.231.157.127]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 8E576CFE0813; Mon, 23 Mar 2026 07:34:56 -0700 (PDT)
Received: from pps.filterd (m0122330.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 62N802xU301577; Mon, 23 Mar 2026 14:33:56 GMT
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h= content-type:date:from:message-id:mime-version:subject:to; s= jan2016.eng; bh=8YUnUjU4asUyXK7igPzp4aK5U6iOBhjjUkp1kQ9zo78=; b= PKrx/V3eBcrwL6Mr13IYlpQpfdP9MMJtb0Nx0vKhn5mqDiZvbJ16zBGwZhbSvkJp 2BKU7dvlJV8LnZwicfpBaWqcamGkIh4AjxFYIy3T4E4dTDD7vLWvAiRFJ/37uOty A/UXEZ0EWSe4w6dffdtuX0sn2NEZYO4lImfabYtvM4p3AAAvb7wq/lhgUqIyMCJQ 2nJphSqnBx8oYDjhxXNEmIB5IWycL9Xsi70gq8OAfBdzrtJB8SdijbhZq2TNQwQh Bm1EgZUWgOnU+QTUhyDL4D/oiWsQPqD7KaSKGyqu8jLI2gAiP4eOqaiRS5GZuPSy Vwvo0j9vrPm1wXmJMKPVkg==
Received: from prod-mail-ppoint7 (a72-247-45-33.deploy.static.akamaitechnologies.com [72.247.45.33] (may be forged)) by mx0b-00190b01.pphosted.com (PPS) with ESMTPS id 4d1kux6fhm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 23 Mar 2026 14:33:55 +0000 (GMT)
Received: from pps.filterd (prod-mail-ppoint7.akamai.com [127.0.0.1]) by prod-mail-ppoint7.akamai.com (8.18.1.7/8.18.1.7) with ESMTP id 62NEJiTR007969; Mon, 23 Mar 2026 10:33:55 -0400
Received: from email.msg.corp.akamai.com ([172.27.50.201]) by prod-mail-ppoint7.akamai.com (PPS) with ESMTPS id 4d1pnu7nq9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 23 Mar 2026 10:33:55 -0400 (EDT)
Received: from ustx2ex-exedge3.msg.corp.akamai.com (172.27.50.214) by ustx2ex-dag4mb2.msg.corp.akamai.com (172.27.50.201) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.29; Mon, 23 Mar 2026 07:33:54 -0700
Received: from ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) by ustx2ex-exedge3.msg.corp.akamai.com (172.27.50.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27; Mon, 23 Mar 2026 09:33:54 -0500
Received: from SJ0PR08CU001.outbound.protection.outlook.com (72.247.45.132) by ustx2ex-exedge4.msg.corp.akamai.com (172.27.50.215) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.27 via Frontend Transport; Mon, 23 Mar 2026 07:33:54 -0700
Received: from MN2PR17MB4031.namprd17.prod.outlook.com (2603:10b6:208:200::22) by SA0PR17MB4157.namprd17.prod.outlook.com (2603:10b6:806:91::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.25; Mon, 23 Mar 2026 14:33:52 +0000
Received: from MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7]) by MN2PR17MB4031.namprd17.prod.outlook.com ([fe80::4b85:d514:5021:bba7%3]) with mapi id 15.20.9723.030; Mon, 23 Mar 2026 14:33:52 +0000
From: "Salz, Rich" <rsalz@akamai.com>
To: Tls <tls@ietf.org>, "spasm@ietf.org" <spasm@ietf.org>
Thread-Topic: TLS Client Certificates; a survey
Thread-Index: AQHcuKVJrYdrF/JPLkipdE9y9SFFBw==
Date: Mon, 23 Mar 2026 14:33:52 +0000
Message-ID: <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ms-reactions: allow
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MN2PR17MB4031:EE_|SA0PR17MB4157:EE_
x-ms-office365-filtering-correlation-id: c4f4939b-ad3a-4ca1-9e85-08de88e934dd
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|10070799003|1800799024|376014|38070700021|56012099003|18002099003|8096899003;
x-microsoft-antispam-message-info: fp5nCoAoPZjTNFUPQDIGhXM8l3fToAi5CC2BxwniOB1Bq3S/xq7O7L6zJghbBpKDKu6CCfafJQZUQ+PTN5H8apOeskMLCg/2nzYAXg7pcfVi1bUwjSIS9YyUbdkfG/xxGzFpl+WssVqyrrvRTw1UIPqGHXdit0r3AzG/B85QhwAijtlGJOBMtvx5byZnmWc8Ngg/hO89mYLkHgxyjr/McbRenLplLsvoHHnRFpdh9Xmx4JH9QhX4lEriaT9DcktKB74u2CR90uwaLOWQvy4CFWY+ulnnr1iUoTJgQ/pGtaOlhff6friCbkLE7YaWovvvWDxRtuo1aRpla6xVztN7rDKlbbS+ytjV2OHzIUhIgDWPWw7OOvjpN6uGFemGz2yfqHJUGjbCofzPIWbHNWPH4ARY3a8Sp/pYnXqRAJF13/jthJFbpaAz0AyJVhf9R5VVvIIs/zdyW974a1lQ3EhB3aWt8l3a2HFqZcd8bsfim2s/j86J22KxRcpcJOI9ukHD9wdk3RKBYzNWBACn6+UPLs9wqMKEtW1lCH9qiI0n4/KayP+rOvKMFK3ttkpNEKipGTH9NGi0Rj9C6vsZTiBsz4K8/70hKPKXARi8fcKxIa+AG7YL2aiB/FLNqCFeExb3RqBf4h5bONj8mIRuqkAeSbvZo+xSQ43cdxc9YPgNhKwmjpG3KYPclinlAPmYQhewMgFwVipAAAebo/b+Hm1sjhAw9Z7XggHrJsrZXpFdqMHoN4I6cc9Uhomrk1WeV04wxaPS9vhWOg2pCmpYNostnW2pEX+Ob6D0/NZxZs5eHcs=
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:MN2PR17MB4031.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(10070799003)(1800799024)(376014)(38070700021)(56012099003)(18002099003)(8096899003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: MCIJbVvJp1ZyjMZ5bef7iF4OlqaMPxwUzc1kjc6JLnRIgirIJFyoGX+q7ajrMMg+9cgvotfM6ZiVvS4AJFNah3S4vaPzzfd3nNW9LjsQDr+owrCbAfSQOjyss2YBB5hfZhS6lqN5Cb1SJvT2tntKR4Luowm+lh7yH1OUxYBVXhC05z9yfLXYciR+qm+hcmXOwTDRDGCOA9YtJ2EKv474oz/FLQOcJODGFomvmfkprohVuSj3G6etyoYZkIy/3cDvMlAldDx1NQCM7qq9VHAusacoZoTqLp0frG34bOUvPSahAi84mG4gIFzidlwFVekjsEkLltZWAFF5Ph/3Y1wz/E5aQjMywgd/PKMfErUkRp2ustDp401qvdyzNFKiu9mtnh+BUsNQxzGSPC8WGZaisS0BO5kF9rGtrULPgNFTjmOrbtywvhVYM2IrUNJsUuvs//ys6nP4WLfQs0WIEpbqZjxmNzuOhMG3yfmwYDmRDs/pSB1WPMvLhIqX2+DboRXZ8VbKjKGB1v8JFThcrHLPQO29mugImB64qK+grxqj236AxLuj3ifYKA8yAyHIjao6ba8BHgo6JZmRyG3Ly2432pFdZHxkVOiNiEj5aEZbxozm8nyHZFdURm33+3hN8pVuIlJ0ZfWC71owaxCwm7vSCruqTDh4wGjGt0fib5SaRUQXd9awSkLRuQy7I8xw8iKVWo5wDPQhLOMUrLm1wjJu7hX+qkS+ZJk+4yUnhJKuQ1xH3BXa5mQSd67bVEgoNxZmsAj1CBl2iP3egE7lt0AZNX5KIuNJt6dE+cpyqSEBBSh0iG791RUkweIdo4cJuRDbCP8Df5gBCIlSeJHZC83uXldJ3dITr8cqUe3vBbyWVoIW5yB0HciXnoMhSrlJxgv5erd16QwMTOLQZiPjoekM8YFxDJGHwFXgPu+xJwoiTk6vfVNHYGxLI/igv2EF9Uu7jFXhkrCy3DIXerYeQLzkofqJ0t+fwhfcRvCM2KNz4irI1tei+hAMCnfuKZauyzKOCBFkaFc9nO4sA/VAJooO9OcUnJD329ogcpCgKXM0uiGv3MdK3v6Q4Ycynw/yNbkwCk2SnSYP/4Ae+l8oHwFIflIBbyqoFnNRbgk6kySozTIIUJxe0Qs/3ir2IATW2lly6sQRNLqWIB1/jglWWYn+PoElvD5+2RLPkgbwTKG+EiWpjjkcJ4DLlATnWVPl2QcjIN7DA3xGUCjbOEksLxXuzsPwekC596NnMO7yC+q4Syn0v3O9DU4s8w3ZEANpzCE2Qicwq0Z1L09+uqIw042ja0Kb7t8DxGQOMN8sWiBEAECzTnRvXcSugrjKSUGX6eE5OWTF3OHISL1VDQ99ds/2Rxw327lVdsqARpB0EZOCZFkAWf6La+S8Ax+fR+aDGiRx1ad3YrG+mvJKIZ8+1pMRb9bdEiLFu3QjJQsHHTFSn8mtpncFJv/FsOc6MfoxCKpVsMSUwx67jGTOFeFjdUI9/5FM0svxDlAG0MRVRg1Y+v85Pg8/rF7sCQ9juBRxt8sXfA3zu8Z7BhGeHl7+1Fl+icTZIpzTHtoa3dTCvbFoKkkc5LvYw77lrD9DroOn0W5emOKFuSs69TQw8DdwWibeBHFddKDsZ+xaVi5E12GlhRzIsmR01zIt3qlPe4hEhj7xR9ZVmXSpIF/aFI6MZMV0XcEzZnXN554ieKEjYSJe09f5zfu3HMUfQMjVXspgbG4z4GSdkR1iZsnQMMPoMTqT/34MBNhjTq81CGmsKFZmxg+II2ra1bk9X8B/944f/CchYT0VDsuZ
x-ms-exchange-antispam-messagedata-1: +k3zDlkJKF3Fgw==
arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=KPqxqa+xm6/vgkMG/uGZ1npybDd7v8zq+6rGe5aMNLl4C9UFFWpTq6aZptmz321jNYxN87ImGlHHfZVAFJpZGvlvzEBJGxSIu8LySikTJu6RirRv6pjzmLfjt3UFnMKZwcDuIIacsZjqS8WE5Y/Sx8ZQBL5DKbTdLARu9F6zm4UqBKS0xtaSEw8YnZXsxzK4jCGJMM2FXeTYlwZLI5VmCQSVKFJszyStw7WT1rbwKUK3ZCxBUQ5zwcQtTOLS/WdvOj/86eGGsCxCZ39BdQJnz25RrruQtDh5R/eI2OlzoGdN2FCutRUl/xtFLTR5faGMNa7DBV4JWbPsY/1fn5PrsA==
arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=fnGfLOlnNe4icoAa4KbXRcI61RisPzolhzDQd0BLKZ8=; b=TCVa6n/phGP36T4lPSdRkL+tbMUUGJdwDUJom/CSYUr2ptjrUZk2nIl9bQkoLTZVWwu8gWr/0qB6/3lrPucDJoScp43UExJ1zjEj637m6Lubdt3MsnnNUvW8U+dcguBCKPcq4ZxLQEy2PGeqS5nDwj861tFZLgtn3YtBB9NgMMTVYDtn8hHX8Rz81DAbeYKJvhWQoUL8VhkcNaooEkVfPRqJzqZERZwLmTFJC3zwvypN5SHJeEtEKvIb/9CptMEBh8omWNmWU66TLFbch1hk3dYnYV+pvj7IaXtmTLAPzldgWMRzCJWQkIg6yufMuWFjy/5YrV0Z64P7M9RNBkTyiw==
arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=akamai.com; dmarc=pass action=none header.from=akamai.com; dkim=pass header.d=akamai.com; arc=none
x-exchange-routingpolicychecked: TwQ5aQVRFreViWTWFOXT3Y2K5luMHk9wLMNdlRm8kHZLzoXfICILOEBLP6XFaZkP9kAvdEJgbRoe6+IKsNqKWcv9t72uavT5zZ2Ec2g4p4NHDW2vLak1YVrEgnh7QhLKOqbqu4gbmE3FXy558vywFAeolVWTgyiPeUMrM+ufUUTapeL/EiSL5FpKR/yWNPHebbwH1bXLehbsLlmop9PHqKvTaUE44HH/oMJo8CRircQKPxJlU+hQGaDTUcob6du2SQvtlOntlqTptLHj3szkcVb9mYDxfSesEGOgad/yVrpDyScRe7ZGrSnRrMWkzPSKpi9iPTK8wnkNP/zcb69ZDA==
x-ms-exchange-crosstenant-authas: Internal
x-ms-exchange-crosstenant-authsource: MN2PR17MB4031.namprd17.prod.outlook.com
x-ms-exchange-crosstenant-network-message-id: c4f4939b-ad3a-4ca1-9e85-08de88e934dd
x-ms-exchange-crosstenant-originalarrivaltime: 23 Mar 2026 14:33:52.8525 (UTC)
x-ms-exchange-crosstenant-fromentityheader: Hosted
x-ms-exchange-crosstenant-id: 514876bd-5965-4b40-b0c8-e336cf72c743
x-ms-exchange-crosstenant-mailboxtype: HOSTED
x-ms-exchange-crosstenant-userprincipalname: ljz1TENDuCuok0HTihp6CG6cEvd6+0DUUP2FFKY0VvtozaHnwkcMYM2SDer7RzHlXZ6ZRlDz+EsPcGfERQPR0A==
x-ms-exchange-transport-crosstenantheadersstamped: SA0PR17MB4157
Content-Type: multipart/alternative; boundary="_000_MN2PR17MB40314193002D42E6ED4F465ACD4CAMN2PR17MB4031namp_"
MIME-Version: 1.0
X-OriginatorOrg: akamai.com
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-23_04,2026-03-23_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 phishscore=0 mlxlogscore=595 suspectscore=0 malwarescore=0 mlxscore=0 spamscore=0 lowpriorityscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.19.0-2603050001 definitions=main-2603230111
X-Authority-Analysis: v=2.4 cv=EZn4hvmC c=1 sm=1 tr=0 ts=69c14f54 cx=c_pps a=3lD5tZmBJQAvN++OlPJl4w==:117 a=3lD5tZmBJQAvN++OlPJl4w==:17 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=Yq5XynenixoA:10 a=VkNPw1HP01LnGYTKEx00:22 a=Ifg-1AOnLHOf1gn6spyb:22 a=4xFXqd-_BHBjZVyr95gr:22 a=slgouLYb1yN3xra4o9kA:9 a=pILNOxqGKmIA:10 a=_W_S_7VecoQA:10
X-Proofpoint-GUID: 8iIMp_kxel_CmtXJC5nx58x1eLCr73Qi
X-Proofpoint-ORIG-GUID: 8iIMp_kxel_CmtXJC5nx58x1eLCr73Qi
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMzIzMDExMiBTYWx0ZWRfXxnZ+vYzNPe/x 43CoNq6Uj+U77pUW3rlfCLAxNu9eksq7mCk6WAoeDdjmY8pzIpCeiAdvSsTSdoFgwZE+WX7oaSl TR/yTXjKnlSm1/uBphI70DF6z720D2dac6uVqljN2N8rZsq0z5DnBD6Hs9qnnNPSr837Ym6pi/f L5bZlZX7gzns3M/V03Y7+U0VB1cOYuuD2YVTLmt159LHMGVaTAuSuKGKifx87B7IbtbYFJ0/9Jz bj0S5OW9fjd28O0VqyOP4hxRqem/8ok0H0lGe8oEr/UPdtesW/uVTGwL07VkHtotlgjm2GDa4mM 2iVMTuIk7Qce2UQtJG/W8x0luQnxGmnhzptaT7HlSRjkMGAlVTDdWlIF5GPs4mu0ldykP++IBa1 9fcsMU346KQDiDtF+dBKJRpO8kkNgsCeH3LXQeEMAagOZiCGYTum3+VdKWW85hAPdPHcnNIbZHi p7MCRdHxHAUY9PoojdQ==
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49 definitions=2026-03-23_04,2026-03-23_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 impostorscore=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2603130000 definitions=main-2603230112
Message-ID-Hash: 56Z7JYNLZ72SNZFUZQYTP3XPVRY2GXW7
X-Message-ID-Hash: 56Z7JYNLZ72SNZFUZQYTP3XPVRY2GXW7
X-MailFrom: rsalz@akamai.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] TLS Client Certificates; a survey
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/RpvdgR7uzDcafJj8CPB7IRtpO3g>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Since WebPKI CA’s will not be able to issue TLS-Client certificates, what are the customers and CAs thinking of doing?

Replies to be will be summarized to both lists. Please be careful if you use reply-all.

v2.46.0 | Report a Bug | By Email | System Status