<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style=""><span style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: rgb(0, 0, 0);">While the BR only specifies how CAA must be implemented/used for TLS certificates the CAA RFC is not limited to just TLS certificates, the
</span><span style="font-size: 12pt; font-family: Calibri, Arial, Helvetica, sans-serif; color: rgb(0, 0, 0);">RFC 8659 (and previously RFC 6844) begins with:</span><br>
</div>
<div style="">
<div style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 15px; margin: 0px; background-color: rgb(255, 255, 255);">
<br>
<blockquote style="color:black;font-size:12pt;font-family:Calibri, Arial, Helvetica, sans-serif;margin-top:0px;margin-bottom:0px">
<pre style="font-size:13.32px;margin-top:0px;margin-bottom:0px">The Certification Authority Authorization (CAA) DNS Resource Record
allows a DNS domain name holder to specify one or more Certification
Authorities (CAs) authorized to issue certificates for that domain
name.</pre>
</blockquote>
<br>
</div>
<span style="margin: 0px;"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">This does make sense as this would create a `deny all, except` principle where you need to give explicit permission
like as in a good firewall configuration. But I agree that there should be a possibility to change permission per certificate type and to drop restrictions where needed (such as for S/MIME with shared mail providers).</span></span></div>
<div style=""><span style="margin: 0px;"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></span></div>
<div style=""><span style="margin: 0px;"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">I'm currently not in favor of having a new S/MIME specific property, and one for client certs, document
signing, etc. as where does it stop. It would also not allow to have separate `iodef` settings for example (or only enable them for TLS).</span></span></div>
<div style=""><span style="margin: 0px;"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br>
</span></span></div>
<div style=""><font color="#000000" face="Calibri, Arial, Helvetica, sans-serif">We could define one new parameter to define the certificate type, the standard already has a reversed policy property which was used in the draft RFC to limit issuance on policy
OID. </font><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">Rob pointed me at the draft CAA specification that had a </span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">policy
property value instead of a CA domain name.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<a href="https://datatracker.ietf.org/doc/html/draft-hallambaker-donotissue-04#section-3.1.2" id="LPlnk">https://datatracker.ietf.org/doc/html/draft-hallambaker-donotissue-04#section-3.1.2</a><br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
This could work with cabforum defined OID's, the advantage from using OID's is that it would support an OID prefix, and it would be easier for CAs to enforce. But it's not very user friendly..?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="margin:0px;font-size:12pt">This would allow:</span>
<div style="margin:0px;font-size:14px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif">
<br>
</div>
<div style="margin:0px;font-size:14px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif">
<pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> $ORIGIN example.com</span></pre>
<pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca1.example.net; policy=2.23.140.1" // Only cabforum</span></pre>
<pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px"><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca2.example.net; policy=2.23.140.1.5" // SMIME</span></pre></span><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca3.example.net; policy=2.23.140.1.2" // DV, OV, IV</span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca4.example.net; policy=2.23.140.1.1" // EV</span></pre></pre>
</div>
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">For
<span style="background-color:rgb(255, 255, 255);display:inline !important">user<span> </span></span>friendliness, we could define a new parameter such as `type` with the same intention but based on a name value:</span></div>
<div class="_Entity _EType_OWALinkPreview _EId_OWALinkPreview _EReadonly_1"></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This would allow:</div>
<div style=""><br>
</div>
<div style="">
<pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="margin: 0px; font-family: Consolas, Courier, monospace; font-size: 12pt; color: rgb(0, 0, 0);"> $ORIGIN example.com
. CAA 0 issue "ca1.example.net"</span></pre>
<pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="margin: 0px;"><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Consolas, Courier, monospace; font-size: 12pt; color: rgb(0, 0, 0);"> . CAA 0 issue "ca2.example.net; type=smime"</span></pre></span><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Consolas, Courier, monospace; font-size: 12pt; color: rgb(0, 0, 0);"> . CAA 0 issue "ca3.example.net; type=tls"</span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Consolas, Courier, monospace; font-size: 12pt; color: rgb(0, 0, 0);"> . CAA 0 issue "ca4.example.net; type=tls-ev"</span></pre><span style="color: rgb(32, 31, 30); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 13.32px; background-color: rgb(255, 255, 255); margin: 0px;"> </span></pre>
<pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Where:</span></pre>
<pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><ul><li><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">ca1 could issue any type of certificate not explicitly specified (so no S/MIME, or TLS certificates in this example)</span></li><li><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">ca2 could issue only smime certificates</span></li><li><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">ca3 could issue any type of TLS certificate except for EV</span></pre></li><li><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">ca4 could issue only EV TLS certificates<br></span></pre></li></ul><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Alternatively, we could define two parameters, one for the certificate type and one for the assurance level, this would give:</span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> $ORIGIN example.com
. CAA 0 issue "ca1.example.net"</span></pre><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px"><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca2.example.net; type=smime"</span></pre></span><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca3.example.net; type=tls"</span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "ca4.example.net; type=tls; level=ev;"</span></pre></pre></span></pre></pre>
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The challenge for all these methods is how do we drop CAA limitations, as we want something like:</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="">
<pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="margin: 0px;"><pre style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255); margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> $ORIGIN example.com
. CAA 0 issue "ca1.example.net"</span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255); margin: 0px;"><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "*; type=smime"</span></pre></span><pre style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255); margin-top: 0px; margin-bottom: 0px; break-before: page;"><br></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">But that is not allowed by the RFC.</span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">If we would define a separate property per certificate type but follow the RFC and honoring the inheritance, we would still have the same challenge of stopping the inheritance .</span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style=""><br></span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt"><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> $ORIGIN example.com
. CAA 0 issue "ca1.example.net"</span></pre><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px"><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issuesmime "ca2.example.net"</span></pre></span><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issuetls "ca3.example.net"</span></pre><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issuetlsev "ca4.example.net"</span></pre></pre></span></pre><br></span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Maybe we could simply create an '</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">unrestricted</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">' parameter to overrule the RFC?:</span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></span></pre><pre style="margin-top: 0px; margin-bottom: 0px; break-before: page;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt"><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> $ORIGIN example.com
. CAA 0 issue "ca1.example.net"</span></pre><pre style="font-size:14px;background-color:rgb(255, 255, 255);margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px"><pre style="margin-top:0px;margin-bottom:0px;break-before:page"><span style="margin:0px;font-size:12pt;font-family:Consolas, Courier, monospace"> . CAA 0 issue "; type=smime; unrestricted=true"</span></pre></span></pre></span></pre><br></span></pre></pre></span></pre>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Paul</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org> on behalf of Tim Hollebeek via Smcwg-public <smcwg-public@cabforum.org><br>
<b>Sent:</b> Monday, October 26, 2020 15:25<br>
<b>To:</b> Neil Dunbar <ndunbar@trustcorsystems.com>; SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> [EXTERNAL]Re: [Smcwg-public] CAA and S/MIME</font>
<div> </div>
</div>
<div lang="EN-US">
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
This is how I feel about the issue. CAA is potentially an interesting improvement to the S/MIME ecosystem, but the current tags and implementation were meant for TLS, and shouldn’t be reused.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
The RFC has an extension mechanism which can easily be used to add new tags for S/MIME issuance, and issuance of other kinds of non-TLS certificates.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
-Tim</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div style="border:none; border-left:solid blue 1.5pt; padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org> <b>On Behalf Of </b>
Neil Dunbar via Smcwg-public<br>
<b>Sent:</b> Monday, October 26, 2020 6:03 AM<br>
<b>To:</b> smcwg-public@cabforum.org<br>
<b>Subject:</b> Re: [Smcwg-public] CAA and S/MIME</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p> </p>
<div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
On 24/10/2020 16:21, Stephen Davidson via Smcwg-public wrote:</p>
</div>
<blockquote style="margin-top:5.0pt; margin-bottom:5.0pt">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Hello:</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
The topic of Certification Authority Authorisation (CAA) has arisen a number of times in relation to the evolving S/MIME Baseline.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
I highlight a discussion on that subject related to the Mozilla policy: <a href="https://github.com/mozilla/pkipolicy/issues/135">
https://github.com/mozilla/pkipolicy/issues/135</a></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
A significant number of email providers – such as gmail.com, outlook.com, protonmail.com, and others – have CAA records.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
Questions for us to address later in our discussions:</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<ul type="disc" style="margin-bottom: 0in;margin-top:0in">
<li class="x_MsoListParagraph" style="margin: 0in 0in 0in 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;margin-left:0in; mso-list:l1 level1 lfo3">
Is CAA a desired requirement of the S/MIME Baseline?</li><li class="x_MsoListParagraph" style="margin: 0in 0in 0in 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;margin-left:0in; mso-list:l1 level1 lfo3">
Should the S/MIME Baseline rely upon the existing requirements stated in the TLS BR, or is the S/MIME use case sufficiently different to merit a separate CAA tag?</li></ul>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<br>
<br>
</p>
</blockquote>
<p>Generally, I'm a fan of allowing organisations (however defined) to specify their policy requirements for publicly trusted certificates via CAA records; so I would say "yes", it is a desired requirement of the S/MIME baseline. I would certainly expect it
to make its way into the root program requirements at some point, and having a pan-root program consensus on those requirements beats having overlapping or potentially conflicting requirements.</p>
<p>That said, I'm not a fan of ninja semantics (changing the meaning of a deployed resource where the deployer might not have considered its eventual full scope) - it seems to me that the "issue" and "issuewild" tags were framed with TLS certificates in mind[*],
and I think extending "issue" to cover S/MIME could have effects on domain owners which were not expected. In other words, we would be saying to them that all certificates are hereby covered, without them having any means of expressing the policy "I want CA
X to issue TLS certificates, but any CA could issue S/MIME certificates"; so I'm less of a fan of reducing the expressive potential of domain owners.</p>
<p>To that extent, I think that I'd prefer tags like "issue-tls", "issue-tls-wildcard", "issue-email", and so on, with similar semantics which work over "issue" and "issuewild" right now. Once those are in effect, then you could extend the "issue" tag to mean
"all certificates" as a shorthand, while leaving finer detailed policy expressions. However, that goes further than anything the S/MIME WG could reasonably pronounce upon. But "issue-email" to cover S/MIME certs falls within its charter and seems to have a
clearer scope. There's even an opportunity to allow domain owners to specify the validation methods permissible for issuance, but that's a whole different discussion.</p>
<p>Just my opinion, of course.</p>
<p>Neil</p>
<p>[*] Genuine question: would "issuewild" have any meaning outside of TLS certificates?</p>
</div>
</div>
</div>
</body>
</html>