Page MenuHome GnuPG

Support fetching S/MIME certificates over DNS via SMIMEA record
Open, WishlistPublic

Description

Hi,
It's my understanding that gpgsm + Dirmngr don't support doing lookups on SMIMEA records for certificates right now. Even if Dirmngr doesn't and isn't going to have code for verifying DNSSEC status (I've seen the previous discussions on the matter with respect to the OPENPGPKEY RR), it would still be a helpful discovery mechanism. However, unlike OpenPGP keys S/MIME is dominated by certificate authorities, and as the SMIMEA record provides another way to check validity, it's very appealing.

For my personal S/MIME certificate, I have an SMIMEA record and the zone is DNSSEC signed, so in principle this allows someone to check its validity without consulting a CA, but again DNSSEC verification is a tall order to ask. My email is jscott@posteo.net; if you'd like to check its SMIMEA record, you can do (on a GNU/Linux system)
$ dig -t SMIMEA $(printf jscott | sha256sum | cut -c 1-56)._smimecert.posteo.net

Thanks for your consideration

Event Timeline

pert created this object in space S1 Public.
werner triaged this task as Wishlist priority.Apr 16 2023, 8:34 PM
werner added a project: Feature Request.