Re: [TLS] [EXTERNAL] Re: Servers sending CA names

Richard Barnes <rlb@ipv.sx> Tue, 18 April 2023 19:03 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D4D1C14CF0C for <tls@ietfa.amsl.com>; Tue, 18 Apr 2023 12:03:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.894
X-Spam-Level:
X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20221208.gappssmtp.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YEIW8lLABr1q for <tls@ietfa.amsl.com>; Tue, 18 Apr 2023 12:02:59 -0700 (PDT)
Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E47CC14EB17 for <tls@ietf.org>; Tue, 18 Apr 2023 12:02:59 -0700 (PDT)
Received: by mail-wm1-x32f.google.com with SMTP id 5b1f17b1804b1-3f09b4a1527so27721515e9.0 for <tls@ietf.org>; Tue, 18 Apr 2023 12:02:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20221208.gappssmtp.com; s=20221208; t=1681844577; x=1684436577; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=/yrL/VOIg64wVEnl//SXGX4oD/+6DAborKaeBrMKWhU=; b=gS43SnbyjVUF9Auq+FOzZ/h7/pJfTajrYaa0DDJ5S0yofS0OlnArztULnP5HO+TSA/ KWLbO8JOnfgm+3bO4YbCg50o58FbyOj3EtT0XS+ULX7Hfgr1+xD20MzVD3Ka7S6yg6fb bfjd6+NLsYR4VQuMlkRNNRA0Bx5vD89+ihuSQtkIO1abDYhvEqAqrZzkWqrjYol4SwIZ wW4y8F0R0xaR+Bm3Yg1RbQZOIRfkzV3yOI1a7iR5EmMWLFJjT1ep1d4ZkXZaYsPfmKge vrLhD3hvhYqIb3QuFFyAtnUbvUwkhGOiE5aqyoJpb/5eqFEfEOTKqa+DI+x5qE3jVpOf CYgg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681844577; x=1684436577; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=/yrL/VOIg64wVEnl//SXGX4oD/+6DAborKaeBrMKWhU=; b=GvYbWXFHh1X1FWOjCicE5uZh8+hjXxfeNKLB7gHXG3BUKJIRETy8mEpnjk8GnPf/UJ 14w1cyr8sP6jUOuUhLLC1UqhjbBFceSTmRLPMEYuPQsNIVRh0bBY3imKNuBHaPGF1zx2 0l15fg0l2+xsk7KabqOJ6GjyAolmdASaaXxaxvc47MXliQYB6WW4oBEomAhA/in2ghKj 1eW/0dA1JnjJ95S1JoiTYXH3L2X1XQEVcaYmGvfgD7EoKZhFJMtXDz5kgojvHjOB8Voq PhLPQvZESkWIlYGWhG8HDqmlvBy8VXjG3W7Fzxgnr34uLNDTXy6SHthTSWzSxlzYMEzb HkYQ==
X-Gm-Message-State: AAQBX9fEvp92/Qr67NrAZ8DEMrb6WK7Q57AjA0S1drMkdyueoFtrugFQ 6X0+4jT71eQ8AoN4HEi+LqG/ukT3LnbkzgPCRMoxIs9SM5Ze/YtR8NUCFw==
X-Google-Smtp-Source: AKy350ZyPcJM4MgliS0+IZ2BlWnEZ3D4L8wcyBzAv7B71BX+0xwRcv0NtwNHRML+ACCSeAnHDA4Y6pAwS02/AJe8I8M=
X-Received: by 2002:adf:f312:0:b0:2c5:5a65:79a0 with SMTP id i18-20020adff312000000b002c55a6579a0mr2919101wro.53.1681844577588; Tue, 18 Apr 2023 12:02:57 -0700 (PDT)
MIME-Version: 1.0
References: <51B56747-0347-43AB-93A7-C3FDF49902D2@akamai.com> <ZDcbv4g5-tjN-Mu-@straasha.imrryr.org> <CAF8qwaBaOq1_Ow_vtB=DGjjDkAx+N+CPMpfn1huP=DRsCiFtaA@mail.gmail.com> <BY5PR00MB06757280F69B9C6D55AD2B048C9BA@BY5PR00MB0675.namprd00.prod.outlook.com> <accacacd-2bd6-4c89-8221-0c32b1a25ae3@betaapp.fastmail.com> <e5970ece-973b-e758-03b5-0e6ea2dc0b1b@redhat.com>
In-Reply-To: <e5970ece-973b-e758-03b5-0e6ea2dc0b1b@redhat.com>
From: Richard Barnes <rlb@ipv.sx>
Date: Tue, 18 Apr 2023 15:02:46 -0400
Message-ID: <CAL02cgT0OyTP3F7qxTZvOXVv=X+=CywbYpYoE95MijPy5yshXQ@mail.gmail.com>
To: Robert Relyea <rrelyea@redhat.com>
Cc: tls@ietf.org
Content-Type: multipart/alternative; boundary="0000000000009d6d3005f9a0f482"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/w3lYkb4Y6J9ah99wDjV3ZM41HIE>
Subject: Re: [TLS] [EXTERNAL] Re: Servers sending CA names
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Apr 2023 19:03:03 -0000

On Mon, Apr 17, 2023 at 11:41 AM Robert Relyea <rrelyea@redhat.com> wrote:

> I know of no public CA which issues SSL client auth certs (or what it
> would mean for a server to trust a public client auth cert).
>

Let's Encrypt issues roughly 3 million publicly trusted certificates per
day that contain the client authentication EKU [1].  Even the White House
has one [2]!

[1]
https://github.com/letsencrypt/boulder/blob/82c1763824bd55669465751d2a8453874f9fc149/issuance/issuance.go#L314-L322
[2] https://crt.sh/?id=9173426978