On 2026-10-11 15:14, Bill Cole wrote:
On 2026-10-11 at 14:16:49 UTC-0400 (Sun, 11 Oct 2026 13:16:49 -0500)
Grant Taylor via mailop <[email protected]>
is rumored to have said:
I hope that Google's et al.'s actions only apply to the direct signing
intermediate certificate. -- In such case, CAs could sign an intermediate
certificate explicitly meant for S/MIME usage and have only that certificate
not be trusted for web PKI.
Sectigo provides an example of one entity issuing both client and server certs.
their pricing of S/MIME certs (and even worse of code signing certs) is
a sign that the world needs more initiatives like Let's Encrypt.
there used to be a dozen providers of "free" S/MIME certs. I have never
checked any of them and cannot say what kind of other monetization there
was. Including https://www.actalis.com/s-mime-certificates that now
offers "subscription pricing" (recommended show: Black Mirror S07E01
"Common People").
by now, to my limited knowledge, there is only Comodo left. For how long?
Accusing Google of intentionally pressuring the CAs is most likely a
conspiracy theory, but there is no denying that their decision has had,
in economic and practical terms, negative outcomes. I am not familiar
with the technical reasons and how they weight in the balance against
the economic reasons.
I do believe that the basic issuance of mailbox validated S/MIME certs
should mirror, in price and ease of use, Let's Encrypt basic issuance of
domain validated SSL certs. The political/power configuration is
different and arguably more fragmented than for SSL certs, but once the
powerful stakeholders are on board, the technological variations should
be as efficient and scalable as Let's Encrypt. What is missing is the
motivation.
Yuv
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
