3 ms·
LetsEncrypt starts signing email certs. That part is easy.
by AdamJacobMuller 6y ago
LetsEncrypt starts signing email certs. That part is easy.
- tialaramex 6y agoISRG (the charity behind Let's Encrypt) has been pretty clear in the past that they aren't interested in doing that. Do you have some particular reason beyond wishful thinking to believe that will change? If you want to build a CA that issues S/MIME certs you can already do that. If you want to leverage ACME you can even do that (using https://datatracker.ietf.org/doc/draft-ietf-acme-email-smime/ https://datatracker.ietf.org/doc/draft-ietf-acme-email-smime... for example). Perhaps you can persuade S/MIME client implementations that your certificates are universally trustworthy, and then you've got the makings of a PKI for S/MIME. But I would not hold my breath.
- AdamJacobMuller 6y agoSure, so, setup your own email cert issuing ACME compliant CA. Still easy.
- tialaramex 6y agoYou're the one who wants this, so it's you that will need to set up a Certificate Authority and then get it trusted everywhere for S/MIME. I genuinely wish you good luck with that.
- bawolff 6y agoOk. How do they verify your identity? LetsEncrypt generally does DV (domain verified) certs only. I guess the equivalent of that would be verifying you control the email address. At that point, what is the practical benefit of S/MIME over DKIM (ignoring encryption)?
- AdamJacobMuller 6y agoThe same way that current email cert issuing CAs do: by sending you an email. end-to-end verification, and encryption.