Alan DeKok <al...@deployingradius.com> wrote:
> Perhaps we should try?
> $ openssl s_client -connect smtp.mozilla.org:587 -starttls smtp >
mozilla.crt
> $ openssl x509 -text -in mozilla.crt
You omitted an important part of that output, which is the name of the CA,
which I include below.
It could be that the CSP permits SMTP, or SUBMISSION service.
Ryan has suggested that CAs could put EAP-TLS (or EAP-TEAP) into their CSP,
and that also seems like an out.
Certainly, some of the excitement for ACME/Letsencrypt with DNS-01 challenge
is that it makes it easy to get a certificate for a non-HTTP thing.
I think we need to fix the lawyers, not the protocol.
The detail:
Issuer: C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
Subject: C = US, ST = California, L = Mountain View, O = Mozilla
Corporation, OU = WebOps, CN = smtp.mozilla.org
But, let's do some more tests:
dooku-[/var/tmp](2.6.5) mcr 10051 %host letsencrypt.org
letsencrypt.org has address 162.243.166.170
letsencrypt.org has IPv6 address 2604:a880:400:d1::89c:7001
letsencrypt.org mail is handled by 5 alt2.aspmx.l.google.com.
dooku-[/var/tmp](2.6.5) mcr 10052 %echo QUIT | openssl s_client -connect
alt2.aspmx.l.google.com:25 -starttls smtp >| letsencrypt.crt
dooku-[/var/tmp](2.6.5) mcr 10053 %openssl x509 -text -in letsencrypt.crt|
grep Issuer
Issuer: C = US, O = Google Trust Services, CN = GTS CA 1O1
CA Issuers - URI:http://pki.goog/gsr2/GTS1O1.crt
What do CA's do?
dooku-[/var/tmp](2.6.5) mcr 10054 %host digicert.com
digicert.com has address 45.60.121.229
digicert.com has address 45.60.131.229
digicert.com mail is handled by 20 us-smtp-inbound-2.mimecast.com.
dooku-[/var/tmp](2.6.5) mcr 10055 %echo QUIT | openssl s_client -connect
us-smtp-inbound-2.mimecast.com:25 -starttls smtp >| digicert-smtp.crt
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global
Root G2
dooku-[/var/tmp](2.6.5) mcr 10056 %openssl x509 -text -in digicert-smtp.crt|
grep Issuer
Issuer: C = US, O = DigiCert Inc, CN = DigiCert Global CA G2
CA Issuers -
URI:http://cacerts.digicert.com/DigiCertGlobalCAG2.crt
What's that quote about doctor's fixing themselves?
--
Michael Richardson <mcr+i...@sandelman.ca>, Sandelman Software Works
-= IPv6 IoT consulting =-
signature.asc
Description: PGP signature
_______________________________________________ Emu mailing list Emu@ietf.org https://www.ietf.org/mailman/listinfo/emu
