On 2026-10-24 at 13:41 -0500, Grant Taylor wrote: > On 10/12/26 1:09 AM, Bastian Blank wrote: > > Chrome is the only of the four root programs that does not include > > S/MIME at all. Since Chrome is a browser and no e-mail program, > > they have no use for it. > > I question the veracity of that. > > I believe the same certificates that are used for S/MIME can / are > used to identify client / end-users via TLS certificates.
While "they are all x509 certificates", identifying a client for S/MIME (emailProtection, OID 1.3.6.1.5.5.7.3.4) is a different purpose than identifying clients via TLS certificates (clientAuth, OID 1.3.6.1.5.5.7.3.2). Technically, you could generate a certificate stating both purposes, but that would miss the point. I don't think any public CA would provide you a S/MIME certificate with other purposes. The reason for that is the same the CAB phased out CA used both for client and server certificates. You don't want that, through some gimmick, a TLS certificate used as a server could be authenticating a client elsewhere. Or, with clientAuth/emailProtection, that signing a malicious email message lets an attacker log in as you to your bank website, nor that by logging into a website with your certificate an attacker could spoof your signature in an email. While it seems relatively unlikely that a mail body could be used as a valid TLS handshake (or vice versa), that's not rigorous. Using different certificates (and, furthermore, moving to a different CA chain) completely eliminates the problem. > Ergo I believe that Chrome does have a use for them. Actually they don't. The Chrome root program cares about CAs because Chrome needs to decide whether to connect to a https:// urls providing certain certificate chain, and then show a green padlock, a certificate error, etc. While Chrome may use a client certificate to introduce itself to a website, it doesn't care about who signed that certificate. It's the server who validates it. (And in fact, if you use client certificates, it's not uncommon to use a private CA to authenticate your users) Best regards _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
