Return-Path: X-Original-To: tls@ietfa.amsl.com Delivered-To: tls@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0052C1A1AE5 for ; Tue, 28 Oct 2014 02:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u1IzYPRPjHMm for ; Tue, 28 Oct 2014 02:55:13 -0700 (PDT) Received: from mx2.auckland.ac.nz (mx2.auckland.ac.nz [130.216.125.245]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09A331A1AD7 for ; Tue, 28 Oct 2014 02:55:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1414490113; x=1446026113; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=Sa7sAzSrLdia90aqXHDXaNKdcfKnKyYZ6+f7IMC1D4M=; b=O7AWW+A2M2ZEnwjaJM6om7uMqWvRHuMQHnowJaHetDHSq06yaQgEmE8d 3ElHw1/SjLg36kIds7UhWAhzTm0u3T5zyUJi8Rzw4eoNFGzNmcDsLxMNs BonD0f+sX8hSrwPvkFBBinRbcjbx2tEIp+8FJM7ZM0kuacXlvvgY0ikKe 4=; X-IronPort-AV: E=Sophos;i="5.04,630,1406548800"; d="scan'208";a="286160515" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 130.216.4.112 - Outgoing - Outgoing Received: from uxchange10-fe1.uoa.auckland.ac.nz ([130.216.4.112]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES128-SHA; 28 Oct 2014 22:55:10 +1300 Received: from UXCN10-5.UoA.auckland.ac.nz ([169.254.5.15]) by uxchange10-fe1.UoA.auckland.ac.nz ([130.216.4.112]) with mapi id 14.03.0174.001; Tue, 28 Oct 2014 22:55:10 +1300 From: Peter Gutmann To: "" Thread-Topic: [TLS] Summary of discussion regarding spontaneuous authentication Thread-Index: Ac/ylUIT3mNYoSbWTeamZIOhdRBC4g== Date: Tue, 28 Oct 2014 09:55:08 +0000 Message-ID: <9A043F3CF02CD34C8E74AC1594475C739B9D9E37@uxcn10-5.UoA.auckland.ac.nz> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/tls/ZbaeWcxxtfyjZJ9eKddLkKF-L8g Subject: Re: [TLS] Summary of discussion regarding spontaneuous authentication X-BeenThere: tls@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 09:55:17 -0000 Eric Rescorla writes:=0A= =0A= >If we make this change, we could still leave CertificateRequest in place, = but=0A= >it could be empty, just indicating that the server wants some kind of clie= nt=0A= >auth and let the client decide. =0A= =0A= Just as a data point, I've always done it that way, the client provides=0A= whatever cert it has to get in and the server decides whether it'll allow= =0A= access. I've never had any reports of problems so far.=0A= =0A= (Caveat: Given the almost nonexistent use of client certs the sample size= =0A= there probably isn't very large).=0A= =0A= Peter.=