[lamps] Re: TLS Client Certificates; a survey

[Viktor Dukhovni <[e-mail]>]

On Mon, Mar 23, 2026 at 10:58:49AM -0500, Nico Williams wrote:

> On Tue, Mar 24, 2026 at 02:26:49AM +1100, Viktor Dukhovni wrote:
> > [ Below, surely a longer answer than solicited.  TL;DR, a workaround may
> >   soon be added in Postfix 3.12 dev snapshots, that avoids the issue by
> >   accepting serverAuth certificates from SMTP over TLS clients. ]
> 
> Is this for SMTP ETRN?

No, and perhaps you're thinking of ATRN instead, but also not for that,
since Postfix does not support ATRN.  Rather it is mostly for policy
servvice callouts, which get to see the issuer and subject CNs only when
the certificate chain is trusted.

Access control by public key or certificate fingerprint is independent
of PKI trust.

But my long answer was not really intended to digress into SMTP access
policy discussions.  Rather, it was an opportunity to give some context
to a workaround that others may find useful in their applications, if
the use-case warrants going there, rather than (generally better)
rethinking whether relying on a third-party CA is the right way to
handle client certs.

-- 
    Viktor.  🇺🇦 Слава Україні!