Subject: [dane] Quick question regarding DANE and S/MIME

From: Alice Wonder <[email-masked]>
Date: Sat, 15 Apr 2017 09:01:10 -0700

When using a 2 x x DANE record for S/MIME - Do I need to then include 
the intermediary (and root?) certificate with the actual user's 
certificate, or is it possible to use something like authorityInfoAccess 
when generating the cert to specify where the intermediary certificate 
that matches the DANE record resides?

--
Sorry for the n00b like question, I'm probably still months away from 
implementing, I have the scripts needed for the root and intermediaries 
set up, but I need to finish carefully inspecting them find a good open 
source OCSP responder because I believe that is necessary if an 
intermediary fingerprint is put in DANE record instead of a self-signed.

This does however really excite me, wish we had DANE validation of 
S/MIME when I first got into computing.

Thank you for your time,

Alice Wonder

---

From: Viktor Dukhovni <[email-masked]>
Date: Sat, 15 Apr 2017 13:31:25 -0400

> On Apr 15, 2017, at 12:01 PM, Alice Wonder <[email-masked]> wrote:
> 
> the intermediary (and root?) certificate with the actual user's certificate,
> or is it possible to use something like authorityInfoAccess when generating
> the cert to specify where the intermediary certificate that matches the DANE
> record resides?

The user's signature needs to (and generally will) include all the certificates
up to and including the "2 x x" trust-anchor.  To maximize the chance that this
will happen publish a "2 x x" for an intermediate, rather than a root (self-signed)
CA.

-- 
	Viktor.