Hacker News Reader

Many systems will not deliver where encryption is not present. Some systems won't deliver without a certificate issued by a public CA. And some systems won't accept an LE cert but require something called OV(organizational validation).

View on HN

>Some systems won't deliver without a certificate issued by a public CA. And some systems won't accept an LE cert but require something called OV(organizational validation).

Which systems are these? Are they public email providers? Are they enterprises?

Enterprises. Porsche.com corporate email for example won't deliver without an OV.

So once you're in the business of providing any kind of general email service you eventually have to deal with it.

Edit: Porsche corporate

I wonder how many side gmail accounts their employees have to use

Volkswagen has similar policies regarding partners and vendors. If you want into that ecosystem they require that you setup specific mail routing policies and mutually authenticated CAs to exchange email.

but delivery to means the receiving end is a server, so they just need server auth TLS certs, not client auth.

That is true. I interpreted your last remarks as meaning you thought that most normal SMTP was outright unencrypted or opportunistically encrypted with self-signed certs.

Reply on news.ycombinator.com