Subject: Re: [Trans] [TLS] Certificate Transparency for Client certificate in MTLS handshake

From: "Salz, Rich" <[email-masked]>
Date: Mon, 10 May 2021 13:03:35 +0000

>  But I have to say, the core problem this proposal
    faces would seem to be lack of demand on the part of folks who
    consume client certificates.

Agreed.  In our experience, client certs are deployed from an enterprise PKI, and the receiving consumers assume valid issuance. I'm not aware of any of our customers (the few that use client certs) who also use a public CA, or even more than one.

Added the trans list.

---

From: Mohit Sahni <[email-masked]>
Date: Mon, 10 May 2021 06:50:14 -0700

Hi Melinda and Rich,
Thank for your comments, I agree that there is not much demand from
the enterprise PKI but with the rise of IOT devices and automatic
enrollment for client certificates, a need for some auditing of all
the issued client certificates is becoming more important. Managing
large services that use client certificates, I feel having some
assurance that the clients have SCT logs and are not revoked will give
me a better sleep at night.

-Mohit

On Mon, May 10, 2021 at 6:04 AM Salz, Rich
<rsalz=[email-masked]> wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Avamander <[email-masked]>
Date: Mon, 10 May 2021 16:55:32 +0300

> faces would seem to be lack of demand on the part of folks who consume
client certificates.
> I'm not aware of any of our customers (the few that use client certs) who
also use a public CA, or even more than one.

With the relatively slow adoption of the EU's eIDAS legislation and thus
national PKIs, the demand will probably grow, but within a decade. But it's
unlikely that countries themselves will show any interest in participating
in this process because the adoption of CT itself is far away.

My humble prediction is that in a decade people will finally start using CT
in the context of MTLS and find it somehow broken, that is if it's not
taken into account right now.

On Mon, May 10, 2021 at 4:04 PM Salz, Rich <rsalz=
[email-masked]> wrote:

> Agreed.  In our experience, client certs are deployed from an enterprise
> PKI, and the receiving consumers assume valid issuance. I'm not aware of
> any of our customers (the few that use client certs) who also use a public
> CA, or even more than one.
>
> Added the trans list.
>
>
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans
>