I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My initial thought was that it would be similar to TLS checks but some things are not apparent to me . Basically, what are the differences between TLS cert validation and S/MIME cert validations.
Do we have to do revocation checking ? Wouldnt that be an overkill for mail to do it every time ? If i am caching CRL/OCSPs for each user certificates that my client finds, wouldnt that require large disk storage. A user can get a signed email from anyone, so there are potentially thousands of users with certificates.
What key extensions need to be checked that are specific to s/mime certs and validation ?
This is in Java and I saw there is a method checkClientTrusted which does chain validation. But it seems that it is not complete. What are the checks that this api does specifically ?