@jmtd I've been using LE on mail.die-welt.net since ever and never had issues (because of that).
@jmtd the value to me is that I don't need to tell my mum "accept this self signed cert"
- replies
- 0
- announces
- 0
- likes
- 0
@jmtd If you have DANE TLSA records you can set MTAs sending to your MTA to require TLS and check the cert parameters (issuer or hash).
@jmtd Mail servers sending to each other on port 25 don't seem to bother checking certificates, but some mail clients submitting to port 587 do, and the lack of a certificate warning makes it a bit smoother to set up.
@jmtd That bit is about *client* certificates. So LE no longer supports their certs being used for authenticating *to* a server.
You can still happily use an LE cert for *any* server end point.
@RogerBW @pndc @jmtd The thing that LE changed (as required by the CA/Browser cartel) was to remove the "client authentication" extKeyUsage from its certificates, which is what would allow two systems to do mutual authentication. The typical MTA asks for a client certificate but makes it optional and doesn't use it in authorization decisions; the TLS protocol expects that servers will only accept client certificates from one or a small number of (typically corporate) CAs.