5 ms·

Let’s Encrypt has said multiple times that they will not offer S/MIME certificates.

yardstick 7y ago
Is there a specific reason they have given for not supporting it? I’m a PGP fan myself but S/MIME is still useful. I’ve found https://community.letsencrypt.org/t/s-mime-certificates/153 https://community.letsencrypt.org/t/s-mime-certificates/153 which seems to imply that it’s because they can’t validate emails securely enough in— although the comment wasn’t from LE staff. Maybe because email certs should last longer than a few months so it wouldn’t be as useful? I’m curious now!
- kevingrahl 7y ago
  Search the forum. If I remember correctly it’s about validation and scalability. I don’t believe they ever gave a good reason not to.
- hannob 7y ago
  HTTPS is a mass feature and LE saw a need to make this available for free and with easier deployment and automation. And if implemented with state of the art technology it's a very robust and secure technology. S/MIME is super niche. Even within the niche of email encryption it's a niche protocol. Also it suffers from loads of security problems and this RFC covers only a small fraction of them (and doesn't do a very good job due to backwards compatibility - it still has a "MUST support" the broken CBC modes).
  - lol768 7y ago
    >S/MIME is super niche. Even within the niche of email encryption it's a niche protocol Compared to what, PGP? As far as I know, S/MIME has the most prevalent support out of the box in email software.
    - jcranmer 7y ago
      To rough orders of magnitude, there's something on the order of a few million users of S/MIME, a few hundred thousand of PGP, and a few billion for DKIM, with DKIM happening for about half of email.
      - lol768 7y ago
        >and a few billion for DKIM, with DKIM happening for about half of email I'm not sure I'd count DKIM in this category, since it's not user-facing.
        Chlorus 7y ago
        Also, does DKIM really provide the same sort of authentication that PGP / s/MIME would? All DKIMs verify is that the message was in fact authorized to emanate from that domain - PGP & S/MIME attempt to confirm that a particular identity belongs to a particular address.
        aaronmdjones 7y ago
        DKIM signs the message headers (including the From: header) and (a hash of) the message body. So you can validate that a message has not been tampered with, and is from the mailbox it says it is (assuming your mail provider rejects messages with an invalid signature, irrespective of e.g. DMARC).
    - hannob 7y ago
      It's been said that S/MIME has more implementations than users. My guess would be there's more PGP users than S/MIME, but I could be wrong (and I doubt anyone has reliable numbers). In any case, everyone should agree that both are super niche.
      - jcranmer 7y ago
        There's almost certainly more users of S/MIME than PGP. PGP keyservers can be well-analyzed for number of available keys, which is somewhere in the region of hundred thousands to millions, with the number of active users probably around a hundred thousand or so. S/MIME is known to be used by the DoD and CAC, which gives it several million users.

Is there a specific reason they have given for not supporting it? I’m a PGP fan myself but S/MIME is still useful. I’ve found https://community.letsencrypt.org/t/s-mime-certificates/153 https://community.letsencrypt.org/t/s-mime-certificates/153 which seems to imply that it’s because they can’t validate emails securely enough in— although the comment wasn’t from LE staff. Maybe because email certs should last longer than a few months so it wouldn’t be as useful? I’m curious now!

kevingrahl 7y ago
Search the forum. If I remember correctly it’s about validation and scalability. I don’t believe they ever gave a good reason not to.
hannob 7y ago
HTTPS is a mass feature and LE saw a need to make this available for free and with easier deployment and automation. And if implemented with state of the art technology it's a very robust and secure technology. S/MIME is super niche. Even within the niche of email encryption it's a niche protocol. Also it suffers from loads of security problems and this RFC covers only a small fraction of them (and doesn't do a very good job due to backwards compatibility - it still has a "MUST support" the broken CBC modes).
- lol768 7y ago
  >S/MIME is super niche. Even within the niche of email encryption it's a niche protocol Compared to what, PGP? As far as I know, S/MIME has the most prevalent support out of the box in email software.
  - jcranmer 7y ago
    To rough orders of magnitude, there's something on the order of a few million users of S/MIME, a few hundred thousand of PGP, and a few billion for DKIM, with DKIM happening for about half of email.
    - lol768 7y ago
      >and a few billion for DKIM, with DKIM happening for about half of email I'm not sure I'd count DKIM in this category, since it's not user-facing.
      - Chlorus 7y ago
        Also, does DKIM really provide the same sort of authentication that PGP / s/MIME would? All DKIMs verify is that the message was in fact authorized to emanate from that domain - PGP & S/MIME attempt to confirm that a particular identity belongs to a particular address.
        aaronmdjones 7y ago
        DKIM signs the message headers (including the From: header) and (a hash of) the message body. So you can validate that a message has not been tampered with, and is from the mailbox it says it is (assuming your mail provider rejects messages with an invalid signature, irrespective of e.g. DMARC).
  - hannob 7y ago
    It's been said that S/MIME has more implementations than users. My guess would be there's more PGP users than S/MIME, but I could be wrong (and I doubt anyone has reliable numbers). In any case, everyone should agree that both are super niche.
    - jcranmer 7y ago
      There's almost certainly more users of S/MIME than PGP. PGP keyservers can be well-analyzed for number of available keys, which is somewhere in the region of hundred thousands to millions, with the number of active users probably around a hundred thousand or so. S/MIME is known to be used by the DoD and CAC, which gives it several million users.