pleroma.debian.social

pleroma.debian.social

Jonathan Dowland jmtd
Is there any value in using a Let’s Encrypt cert for accepting mail with SMTP, over a self-signed cert? From what I recall they set some bit to mark the cert as invalid for this? And nobody verifies the certs for SMTP anyway?

zhenech zhenech@chaos.social

@jmtd I've been using LE on mail.die-welt.net since ever and never had issues (because of that).

Jonathan Dowland jmtd
@zhenech me too, but I recently broke something myself as a consequence of using LE (mod_md directory permission reset, exim couldn’t read it) which makes me wonder if there’s any value
replies
1
announces
0
likes
0

zhenech zhenech@chaos.social

@jmtd the value to me is that I don't need to tell my mum "accept this self signed cert"

Jonathan Dowland jmtd
@zhenech she wouldn’t see that though for SMTP receipt… only for SMTP submission - I’ve outsourced that so they’re handled separately in my case

zhenech zhenech@chaos.social

@jmtd oh okay. That fixes it, I guess.

Jonathan Dowland jmtd
@zhenech thanks for the input. I’m half minded to just outsource the lot now. Spam filtering was the last real obstacle to that. Oh and mailbox size

zhenech zhenech@chaos.social

@jmtd I am pondering outsourcing too. Where did you go to?

Riku Voipio suihkulokki@society.oftrolls.com

@zhenech @jmtd
If I understood correctly, the letsencrypt change forced by google means you can no longer offer a LE cert as client TLS cert when sending mail to other email servers.

Offering LE cert as server cert when others connect to your server at port 25 is still fine.

Jonathan Dowland jmtd
@zhenech mythic beasts. I have their lowest tier email service and only use smtp submission atm. Works like a charm and saves me worrying about IP sender reputation

Jonathan Dowland jmtd
@suihkulokki @zhenech ah I see. Thanks for clarifying!

Csillag Tamás ttyS1@bsd.network

@jmtd If you have DANE TLSA records you can set MTAs sending to your MTA to require TLS and check the cert parameters (issuer or hash).

@pndc pndc@social.treehouse.systems

@jmtd Mail servers sending to each other on port 25 don't seem to bother checking certificates, but some mail clients submitting to port 587 do, and the lack of a certificate warning makes it a bit smoother to set up.

Roger BW 😷 RogerBW@discordian.social

@pndc @jmtd I'm using an LE cert for both and nobody's complained.

@pndc pndc@social.treehouse.systems

@RogerBW @jmtd I mean, I already had the cert-creation and -renewal infrastructure in place so that HTTPS worked, and it was a no-brainer to also have it create certs for all of the other services rather than add a second set of infrastructure to generate self-signed certs.

Athanasius AthanSpod@social.linux.pizza

@jmtd That bit is about *client* certificates. So LE no longer supports their certs being used for authenticating *to* a server.

You can still happily use an LE cert for *any* server end point.

Garrett Wollman wollman@mastodon.social

@RogerBW @pndc @jmtd The thing that LE changed (as required by the CA/Browser cartel) was to remove the "client authentication" extKeyUsage from its certificates, which is what would allow two systems to do mutual authentication. The typical MTA asks for a client certificate but makes it optional and doesn't use it in authorization decisions; the TLS protocol expects that servers will only accept client certificates from one or a small number of (typically corporate) CAs.

Garrett Wollman wollman@mastodon.social

@RogerBW @pndc @jmtd (The browser people have been trying to kill mutual TLS for more than 15 years.)