Can I create a certificate for email, or my own certificate authority? Just wondering…

[image] zagadaa: my own certificate authority Certainly not... [quote="zagadaa, post:1, topic:1196"] a certificate for email [/quote]I think that the certificates will work for mail servers?

[image] kelunik: Yes, certificates will work for mail servers, see Use on non-web servers? . Yes, but if you want to use LE certs for email encryption this is not possible: [image] S/MIME certificates Issuance Policy W…

but it would be epic creating a limited CA, eamsing it can only issue for domains that are verified and that for like a year, so we might have a longer chain but that is intresting, the question is whether or not that would even work, because generally a CA can sign literally any site…

In theory, LE could issue CA certs that include “Name Constraints”, which – again, in theory – describes which names the certificate is allowed to sign other certificates for. Thus, an end user could apply for a certificate for, say, contoso.com , and LE would issue a CA certificate that would only b…

but a limited CA that runs like one year so you also cannot go longer than that (coz 3 year certs have their own problems) is a really epic thing. I just wonder why the support status is so low and I wonder how chrome works about it… but there’s one thing that’s batter than a limited CA, it’s calle…

Well, I’m not sold on the idea that long cert expiries are inherently problematic (though I don’t mind the short ones that LE issues, either – really I just don’t care either way, to be honest). As for Chrome support I can’t find anything specific, but if Firefox supports it, and if OpenSSL supports…

cloudflare already supports it? last time I read they had a beta for like 10 or so people. also overly-long certs, like 3 years give the attacker a lot more time to attack it especially if it was made using broken standards or similar, what we not hope.

Yeah, re-reading my post that does look like what I’m saying, doesn’t it? I actually meant the opposite: Cloudflare does not currently support it (at least not generally – had forgotten about that beta), which I find surprising as it seems like something they’d want to offer before giving everybody …

well they want to do DNSSec White lies (live signing a freshly generated NSEC, keep reading for more) so the user gets more privacy because since everything needs to be signed and usually you keep your key offline until you change stuff the nsec (nothing in here) looks like "there is nothing between…

Will the issuance only be for domains?

Issuance Policy

kelunik September 19, 2015, 10:10pm 3

Yes, certificates will work for mail servers, see Use on non-web servers?.

Topic		Replies	Views
S/MIME certificates Issuance Policy	24	97303	May 30, 2018
Update FAQ about what domains can get LE certificates Site Feedback	9	3054	January 31, 2017
Bringing up LE to match StartSSL's offerings Feature Requests	129	12184	December 13, 2016
Why doesn't Let's Encrypt issue CA certificates? Feature Requests	25	5392	February 7, 2021
Why Letsencrypt certificates are not valid for email? Issuance Policy	8	27455	April 20, 2016

Will the issuance only be for domains?

Related topics