On Sat, Oct 24, 2026 at 1:42 PM Grant Taylor via mailop <[email protected]> wrote: > On 10/12/26 1:09 AM, Bastian Blank wrote: > > Chrome is the only of the four root programs that does not include > > > > S/MIME at all. > I question the veracity of that. > > I believe the same certificates that are used for S/MIME can / are used > to identify client / end-users via TLS certificates.
The Chrome browser is never the relying party that has to decide whether or not a Client Authentication or EmailProtection certificate is to be trusted. Therefore, Client certs, EmailProtection certs, are irrelevant to its roots. While some vendors' root programs only have a restriction that all CAs signed by a specific Root are required to include a restrictive EKU which indicates that CA can sign ServerAuth certificates only or EmailProtection certificates only, but never both. For example, the Chrome Root Program's Policy has this statement: "Intermediate certificates created after January 1, 2019, with the exception of cross-certificates that share a private key with a corresponding root certificate: "1.3.2. Promote use of Dedicated TLS Server Authentication PKI Hierarchies The Chrome Root Store is solely relied upon for TLS server authentication in Chrome; it is not used for any other PKI use case (e.g., TLS client authentication, secure email, code-signing, etc.). To align all PKI hierarchies included in the Chrome Root Store on the principle of serving only TLS server authentication use cases, the Chrome Root Program will phase-out multi-purpose roots from the Chrome Root Store. Beginning June 15, 2026, the Chrome Root Program will phase-out PKI hierarchies found in violation of the below requirements. In these cases, the phase-out date will be set to 90 calendar days following the violation’s detection. All corresponding unexpired and unrevoked subordinate CA certificates operated beneath an existing root included in the Chrome Root Store MUST: if disclosed to the CCADB before June 15, 2026: include the extendedKeyUsage extension and (a) only assert an extendedKeyUsage purpose of id-kp-serverAuth or (b) only assert extendedKeyUsage purposes of id-kp-serverAuth and id-kp-clientAuth. if disclosed to the CCADB on or after June 15, 2026: include the extendedKeyUsage extension and only assert an extendedKeyUsage purpose of id-kp-serverAuth. NOT contain a public key corresponding to any other unexpired or unrevoked certificate that asserts different extendedKeyUsage values. 2. All corresponding subscriber certificates issued on or after March 15, 2027, MUST include the extendedKeyUsage extension and only assert an extendedKeyUsage purpose of id-kp-serverAuth. " ~Chrome Root Program Policy, Version 1.8, Section 1.3.2 https://googlechrome.github.io/chromerootprogram/crp/policy/#132-promote-use-of-dedicated-tls-server-authentication-pki-hierarchies MUST contain an EKU extension; MUST NOT include the anyExtendedKeyUsage KeyPurposeId; and MUST NOT include both the id-kp-serverAuth and i d-kp-emailProtection KeyPurposeIds in the same certificate." ~ Section 5.3, Mozilla Root Store Policy: https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ -- -JA _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
