On Sat, 10 Oct 2026, Ralph Seichter wrote:
* Jasper Spaans via mailop:
Maybe letsencrypt or a competitor could stop doing silly things*, and
actually add a feature that allows the general public to start using
encrypted email with s/mime.</mini-rant>
Sorry for unfairly removing some more nuanced text of yours to make a
point. ;-)
I find it important to occasionally remind younger folk that Let's
Encrypt is a highly valuable gift horse, and thus its mouth should be
very much not looked into. LE has made TLS certificates available to the
general public to an unheard-of degree. I clearly remember the bad old
days where it was either pay for certs, or operate your own CA.
Let's Encrypt certificates and their issuing process were not and are
not meant for S/MIME. It is not about something being broken, but not
being desired or supported to begin with. While I can understand the
wish for somebody out there handing out free S/MIME certs for mail
users, it is not fair to complain about Let's Encrypt not doing it. They
are focused on providing server certificates, and are doing it damn
well.
Based on past discussions, LE doesn't seem to think that handling
end user certificates (a massively higher number than server certs) is
worth doing, and it's their decision to make.
IIUC it isn't that it isn't worth doing, so much as it isn't financially
viable. They did well to use the DNS to identify server owners at
effectively zero cost, but end users are even harder to correctly
identify. Resolving the TOFU issue at no cost is a tough ask.
I tip my hat to the Let's Encrypt crew. You are doing fine work, and
provide a great and valued service.
Seconded.
--
Andrew C. Aitchison Kendal, UK
[email protected]
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
