From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Nico Williams <nico@cryptonector.com>
Thread-Topic: [lamps] Re: [EXTERNAL] [TLS] Re: Re: Re: Re: TLS Client
 Certificates; a survey
Thread-Index: AQHcwhJ73CMI4OIUvEa+JhJkELrY5bXLwgeFgABAFICAAO9zAA==
Date: Fri, 3 Apr 2026 07:38:21 +0000
Message-ID: 
 <SYCPR01MB3661C72DB9D344C301B787F2EE5EA@SYCPR01MB3661.ausprd01.prod.outlook.com>
References: 
 <MN2PR17MB40314193002D42E6ED4F465ACD4CA@MN2PR17MB4031.namprd17.prod.outlook.com>
 <MN2PR17MB40315028C6985BD9F4F0C886CD52A@MN2PR17MB4031.namprd17.prod.outlook.com>
 <acrfWoDSHUrYj1if@ubby>
 <CAKZgXHqKBwYqjB3SOexT1B3=P2m83esgQTV74PJtjk+LGwAhcA@mail.gmail.com>
 <CACf5n7-n6xj35ukPznkes8rDx9-QWi+CDntt2Z5jcM1L+uo1RQ@mail.gmail.com>
 <MEAPR01MB3654DAD44EEA7037763885D0EE50A@MEAPR01MB3654.ausprd01.prod.outlook.com>
 <LV0PR21MB66235C39FFCC9E350BC982DA8C50A@LV0PR21MB6623.namprd21.prod.outlook.com>
 <ac15yB5aylmUnjc6@ubby>
 <MEAPR01MB3654D313ADD0D83693FB21BCEE51A@MEAPR01MB3654.ausprd01.prod.outlook.com>
 <ac6iN4Z6UaUsARHt@ubby>
In-Reply-To: <ac6iN4Z6UaUsARHt@ubby>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
msip_labels: 
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: SYCPR01MB3661:EE_|SYBPR01MB5694:EE_
x-ms-office365-filtering-correlation-id: 654c781b-8abe-4a8f-adfd-08de9153fb07
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: 
 BCL:0;ARA:13230040|10070799003|376014|786006|366016|1800799024|38070700021|56012099003|18002099003|22082099003;
x-microsoft-antispam-message-info: 
 aoVCT1YLpLtXXaIoNeGYzkmHEsrDGGOr/K56ZmqZM2TpF0kouhJDzew0UvrsLVtVVxwsFu9SJLRpN7uJHvcsuy4lJ8VWCTZwuzHfZuwLNnH6FwrfcwsucI7D+cTthSKefqTTn/287k6NA8YvMishYyKzpuO/S7gUMUZyhsQI4MBMnhJQZ63LqqZ/hXYwhk7lsbGuLML7WnBwoMh4PD0RDUqKl77aX4aNamkEqZ4diso3ENY/SJIRT1AO4JtbHPCkMoufShA8fHNPBzLHwTy84eeqQGB6GCUsEoD+7ctrRkOctpwpivjnURzJtpHSKpHbkgeZ13jagDS8Ut3kUNBhWoHR29qu4ojlAGgC/7p3BOZIjNgNAOLodlUMhXLBKpK2lyq77IuMujYc9YTQHCZviQvHv8S5XJpGi7897vkav0E6SsUO1zCWsKgK+Em+HNbEhWVp7Tiir8/CoiDjoUUiAGeU5czYBGzllf4yslKg5pR/JMGW7Llw10pZIQFx2Gc0Q9rzkVb6R/1XbVchSFJerT5DEYD5OrX5P7Wo/ECWU0pSROxZGJwGHnPcwdQpQJedobe+E+jk3zkhgi2TVPZ7zJqo2rRLN72WIq9tfQz1h8RZ/EppgZVaGXxCtHsBDLTHtc63NXb2gNxwREn4U3ccrmkBqhfMz39SuN+k2NVNzQevWAi9cFev5AZ8C8iVXeez58PYReeICDyCKHkswjHwEi+H3rbjrltfMYhGYS4v9aUujVuRek1IBW/NhPmekvkB
x-forefront-antispam-report: 
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SYCPR01MB3661.ausprd01.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(10070799003)(376014)(786006)(366016)(1800799024)(38070700021)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 2
x-ms-exchange-antispam-messagedata-0: 
 =?iso-8859-1?Q?HPDqst2mmu4lf3Vi0N0MbqwvN3c4z//W9xgJZa8cUxZCskRO14HooWlDJ2?=
 =?iso-8859-1?Q?dCzkgDtYYEhGdehBHOx34OJlFr0xbL91eqZ3M2yQZMXpKPa38XmcB8pFVt?=
 =?iso-8859-1?Q?PM1jrjM1rFkfXjBXhHIpm5I0kfWxb7rzeDkl1q44RyN+kh6NH7asITynde?=
 =?iso-8859-1?Q?sGpMD7eSY+ToOfnseBOXsw5ZwGSywQI6s8GBk2iTuzANLX3RFazaOSkeoM?=
 =?iso-8859-1?Q?efS8HoMO104BSb8K8kHIFETDf2Etty6FlOqH8Pc3rtk138OWDZE3bELwJP?=
 =?iso-8859-1?Q?RMRjZnxuKOuDZ1qF4mQUi5USczKNCkHTEWOpI+sX12uvIXC4s7EmTQcSSV?=
 =?iso-8859-1?Q?OxV00muTtTF1WiEqndodYRvqJpeCvYzta9EHmMC6UjgWTEChkY8+iqbGcs?=
 =?iso-8859-1?Q?MDpR+w58XG4T8Z7UkOLpITIzTSJXnQu8sHNu0Fc3iw6+3hodg5pfubfPyq?=
 =?iso-8859-1?Q?kDxKJCQXcIfKYS673wIrWuCbV7wLt9C+/1Dr0nS8fVvBCnSl/+UBn7kjfP?=
 =?iso-8859-1?Q?2qCObJvXZF9s4PsE1gVNhfDyZMF58hcmURzptxQNNRl9CP9juNmPLPhTZd?=
 =?iso-8859-1?Q?ujfAqZV2Z1N8iQYTA4rL6w70zM+GKjzJXjVhMk71SdKwGwRgEmiSit68BA?=
 =?iso-8859-1?Q?Jb6jCa26bUSoIWELJeyGqbj1DZ+n0erSJMBo53KGZnFcjkkLALfpO+Oq91?=
 =?iso-8859-1?Q?I91OlEcVfDAbXCqFfQ1ht7ywdIK+FCpCxqhL86xqPmtR818tnV64Do5Awp?=
 =?iso-8859-1?Q?asL0HNAce0bpoG3YTx6Jak3TuBa0P3QvE2r66Y6bPWEqxltbv/UwRCIRCT?=
 =?iso-8859-1?Q?VGIV6zVdfh8ROpYNEJR1Lzyj2I5Wxwq24SDiC2LmM26w6EHhoUnqlPvVgV?=
 =?iso-8859-1?Q?ToJjQH1OpzI2gi7Bqd7l99QovHnnWRG0wngLEw4wz6Wsikx+bLPcEJzu+0?=
 =?iso-8859-1?Q?TuDrQ9toF5Rlp2gBieSGL5XCBxr2AR/VmOgX8nfkswPMJ9vzo1BOTOI7cV?=
 =?iso-8859-1?Q?S5VeMp38RLCqvA6vx91z6Cjlv87iTorGrxV/32nbwodtdzsODcOgW0B26y?=
 =?iso-8859-1?Q?tYlrOkrRBTRQM2WC1RzWp1v59SoEkYUmQv6/DZra2lTOL9T6i4aBEVoMD9?=
 =?iso-8859-1?Q?mpx83FRkOKmbB+1aejKlC+yeFy03ZELdl16wwZuQR9xu7deuq44J7QhiM9?=
 =?iso-8859-1?Q?aUtTfiLO4E/3E0hjdEcU+lPWsGxndgDmCHO2xnfdikX7Fnj4jYFr+ptoQZ?=
 =?iso-8859-1?Q?xU4SyIJQiw+cYnQK0Z6qiZi711tZ60igJOcRHlDPS0hFn6fYpQIIlC67Wo?=
 =?iso-8859-1?Q?4V6DaC7GXdC29ODmbdlc/nYQ42t67ABjMJCCof8S/U0LCiSHthOHkUpjZR?=
 =?iso-8859-1?Q?aIDZ8fpXofdtsPuKCtTSgbnUv4s7pcp3lF4NvXWpgq9DZr+kD9iAW9eLrv?=
 =?iso-8859-1?Q?E8cE5lxQg0qi6yEZmcrHwaZAyNowPM0RZ+aIF1Os+jlSL9hehGwpg9zjnb?=
 =?iso-8859-1?Q?cZGXm2OwI4B8jXbiwOU9C2ijPEcRltprM3JJ7h4mJI9rnLNkgyJB9rU8Uo?=
 =?iso-8859-1?Q?YLjrkZr67cXYz1XFc8wBgXdHWlxxZUXu0JHPHIn8G4ih4CVwK7F/FcOI8J?=
 =?iso-8859-1?Q?1NQKa2/OUxsGEtwI1PHLJVM6X5JV6wYv6p53VvlUEzFnF9FTiYObS+JPir?=
 =?iso-8859-1?Q?J/TJC4JpaGYFHdsgS3HLDaj5/+Lf1WEYpJUN9/Jf1Mo0B8gii8bOH5Wjrx?=
 =?iso-8859-1?Q?CFlp9TfLkHp+4zPJfm87FRLcHEpdFFGgjvWdE4tfX9Zg2VAsgI2jC+FPn5?=
 =?iso-8859-1?Q?vdMxiglAQUvpLvYKJ3+sLvb887TlfSi0ZVf5x6RF0t+wq+qHRP0iF8L5uu?=
 =?iso-8859-1?Q?vS?=
x-ms-exchange-antispam-messagedata-1: Nh3vWwjVG1mxrw==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SYCPR01MB3661.ausprd01.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 654c781b-8abe-4a8f-adfd-08de9153fb07
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Apr 2026 07:38:21.2756
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 
 fRp8xC/Es2wHPTIwjssGalKIPQkQ5GLahkPPwqBnOHDrzsPcOrJKzLLQacWGNxmv/yHd6JMU8XQMrCoH1Z46Kk2vSnYwOtEhBKJn1UXyZxg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SYBPR01MB5694
Message-ID-Hash: VW5NOXPOJRW6TGZZDBS7UGXGE5TEJVBE
X-Message-ID-Hash: VW5NOXPOJRW6TGZZDBS7UGXGE5TEJVBE
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency;
 loop; banned-address; member-moderation; header-match-tls.ietf.org-0;
 nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size;
 news-moderation; no-subject; digests; suspicious-header
CC: Andrei Popov <Andrei.Popov@microsoft.com>, Tls <tls@ietf.org>,
 "spasm@ietf.org" <spasm@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_=5Blamps=5D_Re=3A_=5BEXTERNAL=5D_Re=3A_Re=3A_Re=3A?=
 =?utf-8?q?_Re=3A_TLS_Client_Certificates=3B_a_survey?=
List-Id: "This is the mailing list for the Transport Layer Security working
 group of the IETF." <tls.ietf.org>
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/aobMOhSPj8QvhyrHj80MdClqYTQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>

Nico Williams <nico@cryptonector.com> writes:=0A=
=0A=
>Recall that we're talking about constraining client certificate use here t=
o=0A=
>just dNSName SAN certificates.  Since KB5014754 at least the mapping of th=
ose=0A=
>to machine accounts from Active Directory should not be trivial to spoof b=
y=0A=
>WebPKI CAs anymore.=0A=
=0A=
I'm not sure whether proposing AD (or some other equivalent, if there is on=
e)=0A=
as a means of managing certificate access control is going to help or if it=
'll=0A=
just make things worse.  There was an OWASP talk a year or two back by some=
one=0A=
who worked for a large pen-testing company who pointed out that, apart from=
=0A=
"nobody ever got hacked by running TLS 1.0", and later on "nobody gets=0A=
breached because they didn't score an A with SSL Labs", that all the=0A=
exploitable vulns they found were from certificate issues or=0A=
misconfigurations, typically in AD CS (Active Directory Cert Services).  Th=
e=0A=
talk was mostly just an hour-long smorgasbord of all the ways things can go=
=0A=
wrong, starting with the ESC1 to ESC8 catalogue and going from there to all=
=0A=
the very-common misconfigurations they'd found, a mixture of both the way t=
hat=0A=
AD CS does things (sometimes bugs, sometimes unexpected quirks) and how eas=
y=0A=
it is to shoot yourself in the foot with it.  It's such a big problem that =
the=0A=
Five Eyes agencies have official guidance on how to (try to) set it up, e.g=
.=0A=
https://www.cyber.gov.au/business-government/detecting-responding-to-threat=
s/detecting-and-mitigating-active-directory-compromises=0A=
(scroll down to "Active Directory Certificate Services (AD CS) compromise"=
=0A=
although it's not compromising AD CS itself but just exploiting the way it=
=0A=
works, and it looks like the guidance only covers the ESC1 stuff, there's a=
=0A=
lot more there than that).=0A=
=0A=
Absolutely not trying to bash AD CS here, it's just the most widely-used me=
ans=0A=
of managing cert-based access control by far and because of this it's a gre=
at=0A=
real-world example of all the ways that things will go wrong.=0A=
=0A=
Peter.=