On 10/10/26 8:47 AM, Ralph Seichter wrote:
I have concerns that a more strenuous read of the industries treatment of the clientAuth Extended Key Usage (EKU) may actually make this considerably worse.That's certainly a better way of expressing it. Sorry if my choice of words was a bit unclear.
I read multiple accounts that (originally) Google would eject any CA from their root certificate program of any CA that signed certificates with the clientAuth EKU. -- So if one wants to be particularly pedantic, Google could eject any CA providing S/MIME certificates which -- as I understand it -- are making explicit use of the clientAuth EKU.
My feat is that any CA that is currently providing serverAuth certs is inherently excluded from providing clientAuth certs. Meaning that it would require a completely independent CA root certificate to sign clientAuth -> S/MIME certs.
Meaning any CA that wants to "also run" (provide) S/MIME certs can't lest they risk their inclusion in Google's root CA program. Something that no CA in the space is willing to do.
I hope that I'm wrong. -- If I am, please politely correct me.I hope that Google's et al.'s actions only apply to the direct signing intermediate certificate. -- In such case, CAs could sign an intermediate certificate explicitly meant for S/MIME usage and have only that certificate not be trusted for web PKI.
-- Grant. . . .
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
