Hacker News Reader

Actalis (the italian CA mentioned in the article for S/MIME certs) generates the certificate for you, i.e. they have the private key.

This is of course completely unacceptable. It's insulting, really.

There are no providers of free S/MIME certificate for private consumers with a duration of 1 year or more.

View on HN

Meh... I agree, but I don't know what to say. Also with TLS certificates you have to trust a third part service. As I wrote, I'm using S/MIME encryption to hide the content of my mails from gmail, not for security.

If you have any suggestion on other S/MIME CA providers, also not free, but is not the price the trouble here, you have to trust someone who generates the certificate.

That’s definitely not true for TLS. Your certificate private key should never leave your possession, outside of a few narrow exceptions (Amazon’s ACM comes to mind). The normal process is to send a certificate signing request, which your CA then signs and returns.

Reply on news.ycombinator.com