<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">No EKU is the same as AnyEKU, and should be treated accordingly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Otherwise you’re diverging from RFC 5280 and there’s no reason to even contemplate that for this.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Ben Wilson via Smcwg-public<br>
<b>Sent:</b> Friday, July 28, 2023 9:45 AM<br>
<b>To:</b> SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> [Smcwg-public] Scope of S/MIME BRs and No EKU in an S/MIME Certificate<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">All,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">For TLS Certificates, I think it was discovered that they would still work if there was no EKU in them (or maybe that was just the chaining down from Intermediate CA certificates). Anyway, I have commented in a discussion on the
<a href="https://url.avanan.click/v2/___https:/groups.google.com/a/mozilla.org/g/dev-security-policy/c/wJ318VEXdTo/m/zM66bPpEAgAJ___.YXAzOmRpZ2ljZXJ0OmE6bzpjMjk5MWFjN2UxMTc0NWZkZWRjYjk1YzgyYzc5N2I3Mzo2OmY5ZTk6NmY0MjFlNjJmNDYwYzdjOTZlMTNjZTZhNGRhYjQ5MTU3YzE2YjIwODUzMzBmZDJjNzIyYWY1ZWQzYjUxOTBjMjpoOkY" title="Protected by Avanan: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/wJ318VEXdTo/m/zM66bPpEAgAJ">
Mozilla Dev-Security-Policy list</a> about the scope of the Mozilla Root Store Policy as it applies to SMIME certificates. Presence of the anyEKU EKU should bring them in scope of Mozilla policy, but what about end entity certificates that have no EKU? Does
anyone want to comment on that thread in MDSP?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ben<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>