Subject: [pkix] An interesting philosophical question

From: Peter Gutmann <[email-masked]>
Date: Sun, 03 Apr 2011 00:52:52 +1300

If you see an SSL server cert that contains an S/MIME Capabilities extension
then, apart from the meta-statement made about the competence of whoever
created it :-), what is one supposed to do with the cert?

Peter.

---

From: Michael StJohns <[email-masked]>
Date: Sat, 02 Apr 2011 22:21:40 -0400

If the server cert has all the correct elements for SSL in addition to the S/Mime extension, the obvious answer is the client should ignore the S/Mime extension.  

I can actually think of a reason to do this: - server is sending secure email notifications as a reaction to something a client is doing. It's somewhat easier to manage a single credential, but maybe not as secure.

Later, Mike

At 07:52 AM 4/2/2011, Peter Gutmann wrote:
>_______________________________________________
>pkix mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/pkix

---

From: "Kyle Hamilton" <[email-masked]>
Date: Mon, 4 Apr 2011 00:46:51 -0700 (Pacific Daylight Time)

I think that one handles it as an SSL server certificate which also happens to contain an expression of whatever S/MIME capabilities the owner of the server wishes to assert for the rfc822name listed as the contact.

If certificates bind authoritative information, then all information within certificates must be authoritative and authoritatively bound to itself.

StartCom issues such that SSL server certificates also include the SSL client EKU.  You could as easily ask "If you see an SSL server cert which also contains an SSL client EKU extension [...]?".

-Kyle H

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 4 Apr 2011 08:29:50 -0400

> created it :-), what is one supposed to do with the cert?

What about a web server that sends automated mailings (e.g., Sharepoint alerts)?

-- T