Hacker News Reader

The headline is misleading. They're killing SMTP CLIENT authentication certificates, not SMTP SERVER authentication certificates.

View on HN

I have to go figure out exactly how this works now, as I'm likely affected.

When my smtp server connects to, eg gmail's smtp server - I'd ordinarily consider my smtp server the client within the scope of that connection.

So am I supposed to present a tlsclient EKU within outbound connections and tlsserver to incoming connections?

When establishing a connection, the client is not usually required to present a CA signed cert. Some environments require this, but not open-Internet mail exchangers.

Reply on news.ycombinator.com