# Using Let's Encrypt for virtual mail hosts

**URL:** <https://community.letsencrypt.org/t/using-lets-encrypt-for-virtual-mail-hosts/2358>\
**Category:** Server\
**Created:** [October 28, 2015, 9:54pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-for-virtual-mail-hosts/2358 "2015-10-28T21:54:42Z")\
**Posts on this page:** 1\
**Showing post:** 17

<div class="post-metadata">

**Author:** ![randy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/randy/32/1214_2.png) [@randy](https://community.letsencrypt.org/u/randy)\
**Post date:** [November 1, 2015, 6:23pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-for-virtual-mail-hosts/2358/17 "2015-11-01T18:23:10Z")

</div>

> this restriction is flagged as "non-critical".

what this really means to X.509 is "you're not required to reject this just because you don't understand it."

> the OID 1.3.6.1.5.5.7.3.11 for this restriction is usually translated to humans as "ServerAuth" (Server Authentication). Don't know where the "web" comes in here, possibly from browser programmers.

RFC 5280 4.2.1.12 says:

id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }  
-- TLS WWW server authentication  
-- Key usage bits that may be consistent: digitalSignature,  
-- keyEncipherment or keyAgreement

So the name says one thing and the comments say something slightly else. Can't imagine how anybody could misunderstand that.

---

_[View the full topic](https://community.letsencrypt.org/t/using-lets-encrypt-for-virtual-mail-hosts/2358)._