Subject: [Uta] SMTP and SMTP/submission

From: Franck Martin <[email-masked]>
Date: Fri, 7 Mar 2014 03:43:05 -0600 (CST)

Reading the various drafts for SMTP, it seems some suggested implementation of TLS for SMTP submission may be radically different with an implementation with SMTP between MTA in the choice of the certificates.. 

In known cases, the submission port and the smtp port is handled by the same server, and likely to use the same certificate for both. There should be some document to differentiate the various uses and indicate which certificate to be used when. 

I think in the list of protocols, we should realy split the generic SMTP in to SMTP and SUBMISSION, so for email it would the following protocols: 
SMTP, SUBMISSION, IMAP, POP 
and the documents indicate to which protocol they refer to. 

using http://www.checktls.com 

I see: 
subject= /C=US/ST=California/L=Mountain View/O=Google Inc/CN=mx.google.com 
gmail.com.        968    IN    MX    40 alt4.gmail-smtp-in.l.google.com. 
gmail.com.        968    IN    MX    5 gmail-smtp-in.l.google.com. 
gmail.com.        968    IN    MX    10 alt1.gmail-smtp-in.l.google.com. 
gmail.com.        968    IN    MX    20 alt2.gmail-smtp-in.l.google.com. 
gmail.com.        968    IN    MX    30 alt3.gmail-smtp-in.l.google.com. 

CN does not match any host 

and when gmail sends it uses: 
subject="/C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com" 
but associated with many hosts, like mail-pb0-x232.google.com, it would be costly to have a specific certificate for every sending IP/hostname. 

finally using SUBMISSION on smtp.gmail.com the certificate is: 
subject= /C=US/ST=California/L=Mountain View/O=Google Inc/CN=smtp.gmail.com 

But you can also submit on port 25 directly, tho this usage is likely to become obsolete due to the various blocks in ISPs for port 25. 

Using the above tool, I cannot see the SRV-ID and DNS-ID in the certificates, but I doubt they are there...