News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by zokier on Wednesday January 19, 2022 @04:26PM (#30000385)
> And in general domain operators don't want their mail providers to have certificates which could be used to impersonate their websites.

> The certificate problem could be solved with SRVName certificates, which permit certificates to be scoped to a particular service on a host.

What about extended key usage extension, doesn't it function similarly without needing to fiddle with SANs? https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by agwa on Wednesday January 19, 2022 @05:21PM (#30001182)
Yeah it seems like EKU could be used for this. But I might be overlooking something.
[ Parent | on HN ]