{"id":18629,"date":"2025-08-11T15:31:57","date_gmt":"2025-08-11T19:31:57","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=18629"},"modified":"2025-08-28T12:55:59","modified_gmt":"2025-08-28T16:55:59","slug":"email-certificate-standards-updated-to-support-acme-automation-future-pqc-security","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/email-certificate-standards-updated-to-support-acme-automation-future-pqc-security\/","title":{"rendered":"Email Certificate Standards Updated to Support ACME Automation & Future PQC Security"},"content":{"rendered":"\n

Changes to the S\/MIME Certificate Baseline Requirements add support for automated mailbox validation (via the ACME protocol) and post-quantum cryptography algorithm testing <\/h2>\n\n\n\n

July 2025 was a busy period in the CA\/Brower Forum\u2019s (CABF) S\/MIME Certificate Working Group (SMCWG). There are two key ballots relating to S\/MIME certificates that have been approved (SMC013) or adopted (SMC012) in the last month:<\/p>\n\n\n\n

    \n
  1. SMC012: Introduce ACME for S\/MIME<\/a> was officially adopted as part of the S\/MIME Baseline Requirements on July 2.<\/strong> This ballot provides certification authorities<\/a> (CAs) with a standardized and automated way to respond to mailbox control validation requests using the ACME protocol. This offers another automation-friendly method for CAs to validate mailbox addresses.<\/li>\n\n\n\n
  2. SMC013: Enable PQC Algorithms for S\/MIME<\/a> entered a 30-day review period that\u2019s set to end Aug. 20.<\/strong> This ballot aims to add the use of two post-quantum cryptography<\/a> (PQC) algorithms into the S\/MIME Baseline Requirements. These certificates are intended for testing (by CAs and clients) and wouldn’t be generally available. However, this move marks yet another step that on the road that ultimately leads to PQC adoption and usage on public networks.<\/li>\n<\/ol>\n\n\n\n

    So, what\u2019s the deal with these two ballots and how are they intended to enhance email security and mailbox domain validations? While these changes won\u2019t directly impact your organization in terms of preparations, our goal is to keep you apprised of the latest S\/MIME industry developments.<\/strong><\/p>\n\n\n\n

    Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n

    TL;DR: An Overview of the S\/MIME Changes<\/h2>\n\n\n\n
    <\/td>SMC012 (ACME Automation for S\/MIME)<\/strong><\/td>SMC013 (Introduction of PQC to S\/MIME)<\/strong><\/td><\/tr>
    What It Is<\/td>A ballot standardizing the use of ACME tokens for email domain & mailbox validation<\/td>A ballot introducing two quantum-resistant algorithms for CA\/CABF member testing<\/td><\/tr>
    What the Ballot Does<\/td>Enables CAs and ACME clients to automate validation using the ACME protocol<\/td>Enables the creation of single-key\/non-hybrid PQC certificates that do not rely upon pre-quantum algorithms for testing<\/td><\/tr>
    When the Changes Will Take Place<\/td>They kicked into effect July 2, 2025<\/td>They will take effect after the IPR review has concluded Aug. 20, 2025<\/td><\/tr>
    Why It Matters<\/td>Adds a modern automation option for S\/MIME validation<\/td>One of the first steps toward the use of PQC certificates on open networks<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Breaking Down SMC012: ACME Automation Extends to Email Validation<\/h2>\n\n\n\n

    The adoption of automation is one of the most pressing topics in our industry today, whether for efficiency gains, or as preparation for the day that PQC arrives, forcing rapid upgrades to keys and certificates. Everything is moving towards automation (for good reason), and email mailbox validation is no different.<\/p>\n\n\n\n

    You see, email domain and mailbox validation have long relied on three existing methods<\/a>, which are predominantly based on server certificate (SSL\/TLS certificate) validation methods. (Think of using validation tokens that are shared via email or are utilized in HTTP- and DNS-based validation methods that prove the requestor controls the domain in question.)<\/p>\n\n\n\n

    This new ACME-based validation method for S\/MIME gives CAs another way to go about verifying email domain or mailbox control that\u2019s already been standardized by the Internet Engineering Task Force (IETF). The method is dependent on both the CA and the client software being able to support ACME for S\/MIME.<\/p>\n\n\n\n

    How It Works: CAs Can Use ACME Randomized Tokens in POST Responses<\/h3>\n\n\n\n

    The recent changes to mailbox control validation, seen in the addition of section 3.2.2.4<\/a> to the S\/MIME Baseline Requirements, enable CAs to generate and use short-lived (i.e., up to 24 hours), one-time use ACME Random Value tokens in response to POST requests. The tokens must:<\/p>\n\n\n\n