On Mon, Nov 18, 2024 at 03:02:59PM +0100, Michael Grimm via mailop wrote:
> > +1. Saving a few bytes transmitting certs is not that compelling with
> > SMTP, so there's a reasonable case for sticking with RSA.
>
> Or provide both RSA and ECC certificates if the MTA in question supports it
> [1].
>
> [1] smtpd_tls_chain_files in the case of postfix
I am loathe to recommend dual cert algorithms, because this is more
complexity than most operators need or want. It also gets tricky to
deploy DANE with DANE-EE(3) cert usage:
https://mail.sys4.de/pipermail/dane-users/2017-August/000417.html
https://mail.sys4.de/pipermail/dane-users/2017-August/000416.html
And even Let's Encrypt then requires TLSA records for 10 intermediate
CAs (5 each for RSA ane ECDSA):
https://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html
or enough skill to include the relevant root CA cert in the chain and
list TLSA RRs for both of the ISRG X1/X2 roots.
--
Viktor.
_______________________________________________
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop
