On Sun, Oct 11, 2026 at 01:16:49PM -0500, Grant Taylor via mailop wrote: > I read multiple accounts that (originally) Google would eject any CA from > their root certificate program of any CA that signed certificates with the > clientAuth EKU.
Where do they use the wording "eject", they use "phase-out"? Also it is the Chrome Root Program, not Google. You can read their policy here: https://googlechrome.github.io/chromerootprogram/crp/policy/ > So if one wants to be particularly pedantic, Google > could eject any CA providing S/MIME certificates which -- as I understand it > -- are making explicit use of the clientAuth EKU. Chrome is the only of the four root programs that does not include S/MIME at all. Since Chrome is a browser and no e-mail program, they have no use for it. > My feat is that any CA that is currently providing serverAuth certs is > inherently excluded from providing clientAuth certs. Meaning that it would > require a completely independent CA root certificate to sign clientAuth -> > S/MIME certs. Yes, this is needed anyway, as multi purpose roots are now gone for good, so one root can not provide both server and S/MIME certs. ISRG does not have an S/MIME root, given there are no useful ACME support for that. Bastian -- Earth -- mother of the most beautiful women in the universe. -- Apollo, "Who Mourns for Adonais?" stardate 3468.1 _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
