> On 15 May 2018, at 07:59, Matthew Hardeman <mharde...@gmail.com> wrote: > > For that matter, can whoever is in charge of gmail.com <http://gmail.com/> > speak to their intent as to CAA for S/MIME? > > I've certainly held certificates which include my personal gmail address > before. At no point did I need or seek Google's blessing to do so. I can > not imagine that was an uncommon case. (At least, not uncommon relative to > the universe of issued S/MIME certificates.)
Well, I don’t see a CAA record for gmail.com <http://gmail.com/>, thus even if CAA issue tags were reinterpreted, as suggested, to cover S/MIME, such issuance would not be prohibited (unlike, say, google.com <http://google.com/>, which does have a CAA record). In other words, those certificates that you were issued hitherto could not have violated CAA policy, since there was no such expression of policy. Regards, Neil _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
