I am working on a S/MIME client development and was wondering if there is a list of certificate and path validation checks that a client needs to perform while validating an email signature. My initial thought was that it would be similar to TLS checks but some things are not apparent to me . Basically, what are the differences between TLS cert validation and S/MIME cert validations.

  1. Do we have to do revocation checking ? Wouldnt that be an overkill for mail to do it every time ? If i am caching CRL/OCSPs for each user certificates that my client finds, wouldnt that require large disk storage. A user can get a signed email from anyone, so there are potentially thousands of users with certificates.

  2. What key extensions need to be checked that are specific to s/mime certs and validation ?

  3. This is in Java and I saw there is a method checkClientTrusted which does chain validation. But it seems that it is not complete. What are the checks that this api does specifically ?


1 Answer 1

  1. Yes, you have to to revocation checking when validating a S/MIME signature. What is different from TLS ist the time aspect. A TLS certificate needs to be valid exactly at the time of validation, while a S/MIME certificate must have been valid at the time the e-mail was created. It doesn't matter if it has been revoked afterwards. This means, that you need to use a CRL for verification, because OCSP responses do not include a revocation time.
  2. The proper key usage must be checked. The certificate mus contain the keyUsage digitalSignature and/or the extendedKeyUsage emailProtection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.