> And in general domain operators don't want their mail providers to have certificates which could be used to impersonate their websites. > The certificate pr

> And in general domain operators don't want their mail providers to have certificates which could be used to impersonate their websites. > The certificate problem could be solved with SRVName certificates, which permit certificates to be scoped to a particular service on a host. What about extended key usage extension, doesn't it function similarly without needing to fiddle with SANs? https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....