This document describes a Transport Layer Security (TLS) extension that allows client certificates to be encrypted in the initial TLS handshake.