1

These instructions describe how to prevent using SMIME with weak ciphers, however it requires an expensive product from Microsoft.

How can I prevent a CA from issuing SMIME certificates that permit the weak ciphers from being used?

1 Answer 1

0

Although in principle you can store anything in an X.509 certificate, there is afaik no S/MIME client that supports encryption capabilities stored in an X.509 certificate. It's the responsibility of the client to decide which encryption algorithm and strength to use when encrypting a message. A sending client can store the supported capabilities inside the CMS blob. The receiving client should then check what the capabilities are and can decide to act upon it. RFC 5751 describes what to do when the capabilities are unknown when sending. RFC 5751 defaults to AES128 when the capabilities are unknown. Older email clients, and perhaps even the latest Outlook releases, default to 3DES since the previous RFC required to use 3DES (or RC2).

It seems that there is actually an RFC for adding S/MIME capabilities to an X.509 certificate (RFC 4262). Not sure however whether this is widely supported. It's probably supported by Outlook since the RFC seems to be created my Microsoft.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .