[TLS] Re: Avoiding the DNS dependency in Trust Anchor IDs

[Ilari Liusvaara <[e-mail]>]

On Mon, Apr 20, 2026 at 03:22:41PM -0400, David Benjamin wrote:
> On Sat, Apr 18, 2026, 02:09 Ilari Liusvaara <[e-mail]>
> wrote:
> >
> > Partial mitigation would be to send TAIs up the chain. But even that
> > would not work in case the servers do not have certificates from the
> > same CA operators.
> >
> 
> This PR isn't directly proposing to do anything with the retry, but, yeah,
> Chrome's implementation just sends the whole intersection, not just one
> match. If it's small enough to send in EncryptedExtensions, a subset of it
> is small enough to send in ClientHello on rare cases of signaling failure.
> (Come to think of it, arguably it should be OK, size-wise at least, to just
> send your whole list on retry because this already expected to be a rare
> recovery event. Hmm...)

I would expect always sending the whole list (avoiding retry entirely)
would be acceptable for non-browser clients. Looking at the OS trust
store, I see 144 certificates. Even at full participation, that would be
in ballpark of 1kB, which seems feasible.

But browsers are whole other ballgame. Intermediate preloading can
make the effective trust store much bigger (ballpark estimate is >10x),
and this can easily blow CH size to territory where increased failure
rate becomes concern.

So I would browsers send mostly send intersection on retry (maybe
augmented with some heuristic matches).




-Ilari