Subject: [imapext] Certificate checking in hosted IMAP environments (POSH BoF in Berlin)

From: Alexey Melnikov <[email-masked]>
Date: Thu, 25 Jul 2013 14:38:31 +0100

Hi,
IETF in Berlin is going to have a BOF session on POSH ("PKIX over Secure 
HTTP").

What people discovered in the XMPP community is that it's effectively
impossible for those who operate XMPP services to obtain and offer
proper (RFC6125-compliant) certificates for hosted domains. CAs won't
give them out ("hey, you're hosting.example.net, not example.com"),
customers won't upload their private keys (why would they?), and
operators don't want those private keys anyway (liability avoidance).

Matt Miller and Peter Saint-Andre describe the problem, mostly from an 
XMPP perspective, here:

http://datatracker.ietf.org/doc/draft-miller-posh/

but this is easily extensible to other protocols.

If you have any feedback on whether the same problem is relevant to IMAP 
deployments, please email me directly.

Thank you,
Alexey

---

From: Brandon Long <[email-masked]>
Date: Thu, 25 Jul 2013 14:08:42 -0700

We haven't seen this issue for imap/pop/smtp-msa, largely because we tend
to offer these services on a subdomain, ie imap.example.com, and the
customers are fine with providing a certificate for the sub-domain.

Even for web cases, we have customers upload www.example.com keys to us as
well.

That doesn't make me opposed to some mechanism like the above.

For outbound smtp, we don't see the issue because we do the mx lookup
first, and then the ssl certificate would match the mx's hostnames instead
of the domain on the email message, so the problem is actually validating
the mx lookup results.

Brandon

On Thu, Jul 25, 2013 at 6:38 AM, Alexey Melnikov
<[email-masked]>wrote:

> http://datatracker.ietf.org/**doc/draft-miller-posh/<http://datatracker.ietf.org/doc/draft-miller-posh/>
>
> ______________________________**_________________
> imapext mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/imapext<https://www.ietf.org/mailman/listinfo/imapext>
>