From nobody Sat Aug 5 09:16:12 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E0B7131DB6 for ; Sat, 5 Aug 2017 09:16:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=devever.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yhzwnevg30f4 for ; Sat, 5 Aug 2017 09:16:07 -0700 (PDT) Received: from umbriel.devever.net (umbriel.devever.net [149.202.51.241]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55960131E75 for ; Sat, 5 Aug 2017 09:16:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with ESMTP id 4774B1D714 for ; Sat, 5 Aug 2017 18:16:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=devever.net; h= user-agent:content-disposition:content-type:content-type :mime-version:message-id:subject:subject:from:from:date:date :received:received; s=mimas; t=1501949765; x=1520139126; bh=9Rb9 WGEuOdcfYIu09jcfR10ZlDX6n8MguGO9EWJOvJM=; b=Zvxh7O23jTSfMWvHh+an PiKZqwKD7GHdrLkuCUoVQ2AsOeMY6bO++ZnxpFNOfAAq+ps8IHO/TVGyMCkIwxSv KIdeKqaYmoJJL3Kkf5VpskCffL1h0B+BjFYDWGnBlknNzBdPRPqbMv1aG2AQ65wu M/Q6cexSACn+7Skbf+83ly9UKUPounPQMU2X6inAuBUjKUSOxz24sO80s+tIAk/H gOl8SMUp6VDwu2X7dABEP0FIE/VEs+314/46isws71JmNwNaWf9PPF/95GRB0zZt Q847eDaZF1SXxkw/bymDuorxMas5DUX0b2JSYYBlaegfjqMkwmLmPYw2qbn0ISwQ FA== Received: from umbriel.devever.net ([127.0.0.1]) by localhost (umbriel.devever.net [127.0.0.1]) (amavisd-new, port 10026) with LMTP id S_pfwIpQQiqv for ; Sat, 5 Aug 2017 18:16:05 +0200 (CEST) Received: from andover.lhh.devever.net (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with SMTP id 07F891D711 for ; Sat, 5 Aug 2017 18:16:04 +0200 (CEST) Date: Sat, 5 Aug 2017 17:16:04 +0100 From: Hugo Landau To: acme@ietf.org Message-ID: <20170805161604.GA17053@andover.lhh.devever.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.8.1 (2017-04-11) Archived-At: Subject: [Acme] Proposed wording for CAA validation-methods section X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Aug 2017 16:16:10 -0000 Since the consensus seems to be to change to "validation-methods", here's the wording I propose for the validation-methods section: Extensions to the CAA Record: validation-methods Parameter ========================================================== A CAA parameter "validation-methods" is also defined for the "issue" and "issuewild" properties. The value of this parameter, if specified, MUST be a comma-separated string of challenge method names. Each challenge method name MUST be either an ACME challenge method name or a CA-assigned non-ACME challenge method name. The presence of this parameter constrains the property to which it is attached. A CA MUST only consider a property with the "validation-methods" parameter to authorize issuance where the name of the challenge method being used is one of the names listed in the comma-separated list. Where a CA supports both the "validation-methods" parameter and one or more non-ACME challenge methods, it MUST assign identifiers to those methods. These identifiers MUST be chosen to minimise the likelihood of conflict with any ACME challenge method name; it is RECOMMENDED that, at the very least, CAs avoid assigning identifiers ending in a hyphen and two digits ("-00"). A CA SHOULD assign individual identifiers to each of its non-ACME challenge methods. However, if it is unable or unwilling to do so, it MAY use the fallback identifier of "non-acme" to identify such methods. From nobody Sun Aug 6 00:30:01 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8384B132018 for ; Sun, 6 Aug 2017 00:30:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.699 X-Spam-Level: X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ReO5wgCZXgG6 for ; Sun, 6 Aug 2017 00:29:58 -0700 (PDT) Received: from mail-wm0-x235.google.com (mail-wm0-x235.google.com [IPv6:2a00:1450:400c:c09::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9030132016 for ; Sun, 6 Aug 2017 00:29:57 -0700 (PDT) Received: by mail-wm0-x235.google.com with SMTP id m85so46986117wma.0 for ; Sun, 06 Aug 2017 00:29:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=KW1kOILK9SaAm9lHltWDWY76i/ZRxFLrYL6f/cAXRxY=; b=BXirg1w6R087aAdJUxqbhAxge7QeTgCNqLtEGvy49CiKZGZxgfMccMp0iKSxcVucH+ G7AGp3hmP3z6C722Xe3odCPdvYSiPuuuHUbt+IqpnS0+IFu4dUVQnqfx7JBfr8Hbb9Ra xKU/aAJmmrW6zZL9mNquM0Nc6z+1F1NOyISNHMDQRpiQCD0+yk+oZF3blVndhZYaqmyr XVNpyOWBSFzT6KLaWVY8Ng2HP4UCSM06LfTLTMw5GsGOrRjeKF8v3qweoHzHXwaBDgJV rD+tLNRRnZjqXI6aSdjOBOvpY421ZJKqqRPz0W/x6Wi48kVFIqe6cqKIX97irRInvwqC Pu9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=KW1kOILK9SaAm9lHltWDWY76i/ZRxFLrYL6f/cAXRxY=; b=MoyRhqnrbsdUuK/GstUldx5GvFsDStRYNXZKCmXLRlM8p4HQGjJB9LAMEPaV2IDeAD Bx5JOjiQ3P4jWVF2ehQahFVQdqfrGpYEIUbA6hxGXqqv/Umb9YaTD2EDSKXFCOeYN/WD Oqg/RV0+GfpfQhiNFpFqegoh3CkOiMleArW22us81dcp+rI25pdwGPyIRdCil/e3AfWE k6J2tylimyR0fW6TLCadL0WaHVtoyiNrdgakA3FwKjIx7Dg9rR3MvQgVuWOKThgz96io HYnx5lGoaW/8meZgh/FhyT4gBV8dj9otfMDAY1WAxe1sjb/jVwXC7gKdcac1ZPorttJ7 aV/g== X-Gm-Message-State: AHYfb5iFsNTPVbni6/YrG3kevuQsoqN0YY2fALG6Y61yIXfyRuqPzc5q 3NFl7ri1EGutBgw6mPQ= X-Received: by 10.28.191.157 with SMTP id o29mr5135638wmi.121.1502004595821; Sun, 06 Aug 2017 00:29:55 -0700 (PDT) Received: from [172.18.133.23] (cowboy3.intuit.com. [65.204.229.13]) by smtp.gmail.com with ESMTPSA id y203sm6387899wmc.27.2017.08.06.00.29.53 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 06 Aug 2017 00:29:54 -0700 (PDT) To: acme@ietf.org References: From: Yaron Sheffer Message-ID: Date: Sun, 6 Aug 2017 10:29:47 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Acme] Proposed wording for CAA validation-methods section X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Aug 2017 07:30:00 -0000 The second paragraph is hard for me to parse. Let me try to reword it. The presence of this parameter in a property further constrains certificate issuance for that property. Whenever the parameter is included in a property, a CA MUST NOT use any validation method unless the method is explicitly listed. Thanks, Yaron > > Since the consensus seems to be to change to "validation-methods", > here's the wording I propose for the validation-methods section: > > Extensions to the CAA Record: validation-methods Parameter > ========================================================== > > A CAA parameter "validation-methods" is also defined for the "issue" and > "issuewild" properties. The value of this parameter, if specified, MUST > be a comma-separated string of challenge method names. Each challenge > method name MUST be either an ACME challenge method name or a > CA-assigned non-ACME challenge method name. > > The presence of this parameter constrains the property to which it is > attached. A CA MUST only consider a property with the > "validation-methods" parameter to authorize issuance where the name of > the challenge method being used is one of the names listed in the > comma-separated list. > > Where a CA supports both the "validation-methods" parameter and one or > more non-ACME challenge methods, it MUST assign identifiers to those > methods. These identifiers MUST be chosen to minimise the likelihood of > conflict with any ACME challenge method name; it is RECOMMENDED that, at > the very least, CAs avoid assigning identifiers ending in a hyphen and > two digits ("-00"). > > A CA SHOULD assign individual identifiers to each of its non-ACME > challenge methods. However, if it is unable or unwilling to do so, it > MAY use the fallback identifier of "non-acme" to identify such methods. > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > > > ------------------------------ > > End of Acme Digest, Vol 34, Issue 1 > *********************************** > From mikedanese@google.com Wed Aug 16 18:25:08 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C670132400 for ; Wed, 16 Aug 2017 18:25:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bwCZbx3kOh8R for ; Wed, 16 Aug 2017 18:25:06 -0700 (PDT) Received: from mail-wr0-x230.google.com (mail-wr0-x230.google.com [IPv6:2a00:1450:400c:c0c::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2DB45126BF0 for ; Wed, 16 Aug 2017 18:25:06 -0700 (PDT) Received: by mail-wr0-x230.google.com with SMTP id 49so21951558wrw.2 for ; Wed, 16 Aug 2017 18:25:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=rIYbyDK+jrNJqp6vr4+Gif72hZOi/CbEG5fVL+DLb48=; b=aKfbvIA/tqTxnnqHmy0gqwz0ipsGhyeHO8cQU5nsYCVGDCkOj7VCZD7/1QG9qHko4k hxqNkaLCd/vXjOxpe2N7HKcfeyp9SAnGa3Gz0aUg8IYWAAujX3jMOy+Z3qej9irYISkI 3UJHVrpW3uMzXbZb8lITcfU4ZjB2stDLLcmw/1heKicWMHHVsr/vUrmmLbc34aKv91f5 GvF/3C8+sq8kX7j/uY771TJj5qRuSURcP6FHwksfdfCRfB7Nj/nySIypSn40idgjlB93 zypmqi4b1VtcHl+A2byWdNMnHjnYae8Y7wihZrmCgLzNsQE0dI9OY2aZIIjmAjXSytUj 0dJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=rIYbyDK+jrNJqp6vr4+Gif72hZOi/CbEG5fVL+DLb48=; b=gjMB+fZbOZ454Wu7mgSleqBwhEHz+iMTNBMnRzkg+aZOV8GimLqlNUU0N3HncEj4Qv BIod617RaHq1iF3Vz54RzQ8pbwkjNCSPKrZM24qNDWNlA5gmwkPqCuSw+3lvOUTr86E3 8eggmAo5lh3IpBQT2JJ5+czjdwjTShDStUgI8OIbEsv6VwvpuFa84m42blYaQuV7+uPO PlZDOxL99wprNC3tZg8tnCvh/abP/7A0JyUZCkOK07pi4Cwop4Zq+mVtsqiw3nBtjaeS /0VUcmu6lBjvWWpleATmrnxSYQ2z9LNLjA3rJbs1cN2gTBq7Ieojy2+ADt+CPUY7BWB4 p14g== X-Gm-Message-State: AHYfb5i3NaGUZ4dgH2yAqs/mAT6ddaAOJpqWRKkHxBeGQyP2zRt2/abR nCgMzu6Eh9nwT/9eCWwMe/e+AXjCiYzrmZU= X-Received: by 10.28.132.212 with SMTP id g203mr137432wmd.145.1502933104256; Wed, 16 Aug 2017 18:25:04 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.101.195 with HTTP; Wed, 16 Aug 2017 18:24:23 -0700 (PDT) From: Mike Danese Date: Wed, 16 Aug 2017 18:24:23 -0700 Message-ID: To: acme@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: X-Mailman-Approved-At: Thu, 17 Aug 2017 04:58:57 -0700 Subject: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 01:26:49 -0000 Hello, It's unclear to me whether an ACME CA is allowed to issue a cert with a superset of identifiers that were requested in the order. I see the language: > The server MUST return an error if it cannot fulfill the request as > specified, and MUST NOT issue a certificate with contents other than > those requested. If the server requires the request to be modified in > a certain way, it should indicate the required changes using an > appropriate error type and description. https://tools.ietf.org/html/draft-ietf-acme-acme-07#section-7.4 Due to this statement, I suspect the answer is no but the meaning of "fulfill the request as specified" is pretty ambiguous w.r.t. changes that are purely additive. Thanks for clarity, Mike Danese From nobody Thu Aug 17 06:54:25 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFF761323AF for ; Thu, 17 Aug 2017 06:54:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1D9wNBrZDwPn for ; Thu, 17 Aug 2017 06:54:22 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AA3A132063 for ; Thu, 17 Aug 2017 06:54:21 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.21/8.16.0.21) with SMTP id v7HDq4NG013126; Thu, 17 Aug 2017 14:54:19 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=mdIlFlNaM4fDqaZ9sLDqEYlyIjYL0EYMYdHUNvNqOhM=; b=O0SCnzhNEcD5f3M2GfeIsFs3oAhPxOf6t6f5zHSy/X/CGsDRTpNjarOpkEphVPWKoUk2 2t1ws3AwnhpdSw+tNALFOrlEwfXwV5IH7JIg41n3TU4pTAm7ATV5Toq6YD1bLNSvxMor oEOTxndOSTvjhASn6wsSM+/qhitL7us9W2pJ+RPgfhLUJ0QVGMETEHRH6xMXoTm6l2xQ 4Pd/1XdvJqniydnff64KSaHZcku8oix8Y3zZtHkt1mQI2bVPTDPe4sCQpMitag3JbPXk UKVbbpNsUf2FuKYRW+YqEsqA6msbhzToTMy39gX3y5divNt3TryO7FA8me1gmqVzWGKr Pw== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050095.ppops.net-00190b01. with ESMTP id 2cc6dw6hmn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 14:54:19 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7HDp0KZ003250; Thu, 17 Aug 2017 09:54:18 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint1.akamai.com with ESMTP id 2cc6cvfc8d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 09:54:18 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 17 Aug 2017 09:54:17 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Thu, 17 Aug 2017 09:54:17 -0400 From: "Salz, Rich" To: Mike Danese , "acme@ietf.org" Thread-Topic: [Acme] Issuing a cert with a superset of requested identifiers Thread-Index: AQHTF1A3hB2D7UrUB0eD4veudPLDMqKIkgSA Date: Thu, 17 Aug 2017 13:54:16 +0000 Message-ID: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.34.156] Content-Type: text/plain; charset="utf-8" Content-ID: <80C5F40AF59988438B2BD99CB100A5D3@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170230 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170230 Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 13:54:24 -0000 IA0KICAgIEl0J3MgdW5jbGVhciB0byBtZSB3aGV0aGVyIGFuIEFDTUUgQ0EgaXMgYWxsb3dlZCB0 byBpc3N1ZSBhIGNlcnQgd2l0aA0KICAgIGEgc3VwZXJzZXQgb2YgaWRlbnRpZmllcnMgdGhhdCB3 ZXJlIHJlcXVlc3RlZCBpbiB0aGUgb3JkZXIuIEkgc2VlIHRoZQ0KICAgIGxhbmd1YWdlOg0KICAg IA0KICAgID4gVGhlIHNlcnZlciBNVVNUIHJldHVybiBhbiBlcnJvciBpZiBpdCBjYW5ub3QgZnVs ZmlsbCB0aGUgcmVxdWVzdCBhcw0KICAgID4gc3BlY2lmaWVkLCBhbmQgTVVTVCBOT1QgaXNzdWUg YSBjZXJ0aWZpY2F0ZSB3aXRoIGNvbnRlbnRzIG90aGVyIHRoYW4NCiAgICA+IHRob3NlIHJlcXVl c3RlZC4NCg0KVGhlIOKAnGFuZCBNVVNUIE5PVOKAnSBjbGF1c2UgbWVhbnMgdGhhdCBib3RoIHBh cnRzIGFyZSByZXF1aXJlZCB0byBiZSB0cnVlLiAgU28gaWYgeW91IGFzayBmb3IgQSBCIGFuZCB5 b3UgYXJlIGdpdmVuIEEgQiBDIHRoZW4gdGhlIHNlcnZlciB3YXMgbm90IGNvbXBsaWFudC4NCg0K From nobody Thu Aug 17 08:05:08 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B92A61321B7 for ; Thu, 17 Aug 2017 08:05:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i9Rr66fB_-gE for ; Thu, 17 Aug 2017 08:05:04 -0700 (PDT) Received: from mail-wr0-x232.google.com (mail-wr0-x232.google.com [IPv6:2a00:1450:400c:c0c::232]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 822BD132153 for ; Thu, 17 Aug 2017 08:05:04 -0700 (PDT) Received: by mail-wr0-x232.google.com with SMTP id f8so1654763wrf.3 for ; Thu, 17 Aug 2017 08:05:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=KnGuSsOhyBHAfXaNy3DVh/160Pw6EDIQz6qimXCX5J8=; b=B73vIMpMZlNqI0fwMKlw428MHIabAdhktrwuAUirvDE6xBCHnVafGumpbMMniWES/6 Htm8d28or5cyS+niZ/wez2z0dtxkvimfZkx4iyeuz1sF6IpfUobzvJvntex/X/Bkvxsx AlTtYZBDAc6LoToogd+SoaQyqFm7KtpZkh+laHMMNhHI07WQMhFTNpfred+nSMuwe1gB uBDR0FxdNSsNtWz1DcrWsm4DmKo6zHXG1TnwPJwiwyQUBnyfpNPmdZ51cynlWIeaQEod +tDGWOPOhxCW6OqJcoVGne3Y/z0PSeZonkOm05zlDyoahktDOhxexsxxtKz9lzUNyEsk spNg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=KnGuSsOhyBHAfXaNy3DVh/160Pw6EDIQz6qimXCX5J8=; b=RUkakOoWIs6/oKnZjeGuLKHQQ9O3qjtCMsXZidtC63Y5OBgxNjPP1q0jh3k1tNa/Xx Zc1cheSXxuym4GZlfglGaI/tr9LzEzrVUNYqv/JKxaEMB4prQxDNs0GFNdZhyIRC894r f4fMjHSv/W0ryH2CWidDWOASgHmSFucWD+lcpSTTFKBhtONLYKDa8fo7Eyvg1nmPLl1Q ULz7HoUsocbJt3JhpSoWfQkxkexZ2EADM6NKKFyMQyox0bhOzScv2j0EpHr5eR/sZkZk ePWiNirF2rwoPulDWiExFCiZkFruDITlrprNQc/8Ar4kFO3JnS11NVBfk+DDt6C5HllX WV/w== X-Gm-Message-State: AHYfb5gK/4zivlyM1q2ufRpXpllvuIhghOUv6+cd+d7T7Fjlh1pZUrJd ZlIinjJ1qdENsu4QBFyqWeeb2rG8ViBu X-Received: by 10.28.51.148 with SMTP id z142mr1340667wmz.92.1502982302817; Thu, 17 Aug 2017 08:05:02 -0700 (PDT) MIME-Version: 1.0 Received: by 10.28.225.5 with HTTP; Thu, 17 Aug 2017 08:05:02 -0700 (PDT) In-Reply-To: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> From: Richard Barnes Date: Thu, 17 Aug 2017 11:05:02 -0400 Message-ID: To: "Salz, Rich" Cc: Mike Danese , "acme@ietf.org" Content-Type: multipart/alternative; boundary="001a1143bb884372310556f4565d" Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 15:05:07 -0000 --001a1143bb884372310556f4565d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Yeah, I agree that the intent here is for the CSR to match the certificate in all material respects. This does require the client to know what it wants, so it knows what to put in the CSR. Do you have a use case where that's not the case? On Thu, Aug 17, 2017 at 9:54 AM, Salz, Rich wrote: > > It's unclear to me whether an ACME CA is allowed to issue a cert with > a superset of identifiers that were requested in the order. I see the > language: > > > The server MUST return an error if it cannot fulfill the request as > > specified, and MUST NOT issue a certificate with contents other tha= n > > those requested. > > The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are requi= red to be true. > So if you ask for A B and you are given A B C then the server was not > compliant. > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > --001a1143bb884372310556f4565d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yeah, I agree that the intent here is for the CSR to = match the certificate in all material respects.

Th= is does require the client to know what it wants, so it knows what to put i= n the CSR.=C2=A0 Do you have a use case where that's not the case?
<= /div>

On Thu= , Aug 17, 2017 at 9:54 AM, Salz, Rich <rsalz@akamai.com> wrot= e:

=C2=A0 =C2=A0 It's unclear to me whether an ACME CA is allowed to issue= a cert with
=C2=A0 =C2=A0 a superset of identifiers that were requested in the order. I= see the
=C2=A0 =C2=A0 language:

=C2=A0 =C2=A0 > The server MUST return an error if it cannot fulfill the= request as
=C2=A0 =C2=A0 > specified, and MUST NOT issue a certificate with content= s other than
=C2=A0 =C2=A0 > those requested.

The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are = required to be true.=C2=A0 So if you ask for A B and you are given A B C th= en the server was not compliant.

_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme

--001a1143bb884372310556f4565d-- From oliver@weyhmueller.net Thu Aug 17 10:21:53 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7888132359 for ; Thu, 17 Aug 2017 10:21:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.698 X-Spam-Level: X-Spam-Status: No, score=-2.698 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=weyhmueller.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vcMTlFb62gft for ; Thu, 17 Aug 2017 10:21:51 -0700 (PDT) Received: from mail-lf0-x230.google.com (mail-lf0-x230.google.com [IPv6:2a00:1450:4010:c07::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5ED51132320 for ; Thu, 17 Aug 2017 10:21:51 -0700 (PDT) Received: by mail-lf0-x230.google.com with SMTP id f7so12833460lfg.4 for ; Thu, 17 Aug 2017 10:21:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=weyhmueller.de; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=a19elumXA9su5Ol/kJU9NjbWJVQzfBU5v4aNYDw345M=; b=mEFnoij+7I8TyQ3QLMbuRm+KwP3QcdtpDF22xC6bBJwtSSSV0w2PEuc9p4A2NsXsAt LP2SheWmFbSLaCanJP8WH9ULwxocPY9i18j4R2lYkDJwNBTAn+kMVsN02uRftIQYg5XL VNxYZvwVWba+v5xseZk63ISgZ9iQ8kUZ5nCr8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=a19elumXA9su5Ol/kJU9NjbWJVQzfBU5v4aNYDw345M=; b=cBeUMof6F6S+licooioV0yPraWssQmAyClss1Xlk+gqoDrlhzabxjH6QV4tmWxcVMO dqG0UfiTjoGjtpBfV8vcHD/9HWGaE1Vv6zo/gNb98q+qQpqWyckxfupOMeWf9LpbW5UZ AkxjkFjBkMnaS8NKZTjwwoy7QCo0Vm+wkztsSrvGqbm6qMedUuVl5e8XUfBEOShcwi/s fhgZ6wxZZsEeuZv2aquO8jja0otJToXohLei17DgsXw/IxpgCKudxOn6YozTFZPl0cWG AgCDdlwPXFL73PB7EcMg5cVBaYmHFa+p1YpjUNVQO/YsasiAlb96HtynHzPVUWAhAc6D aHag== X-Gm-Message-State: AHYfb5gZaIjpUi0xkXHgK+4axpvN69HIxB2354SAGoZkdyZbAOuUwmP9 Y2gq+H1Q6J80uH35KUxb+cyOZztW/MoA X-Received: by 10.25.171.18 with SMTP id u18mr2493966lfe.21.1502990509301; Thu, 17 Aug 2017 10:21:49 -0700 (PDT) MIME-Version: 1.0 References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> In-Reply-To: From: =?UTF-8?Q?Oliver_Weyhm=C3=BCller?= Date: Thu, 17 Aug 2017 17:21:38 +0000 Message-ID: To: Richard Barnes , "Salz, Rich" Cc: Mike Danese , "acme@ietf.org" Content-Type: multipart/alternative; boundary="94eb2c1cbbf46889dc0556f63f7b" Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 17:25:00 -0000 --94eb2c1cbbf46889dc0556f63f7b Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, I work at a "legacy CA" and there it is quite common to substitute all components of the certificate subject except the CN when a DV certificate is issued. Also OV and EV certificates normally include information in the subject, that are not part of the requesting CSR. We think about implementing ACME, and see some potential use cases for that. For example, a customer's order could only specify a CN in the subject to get a free DV certificate just like LE does. In parallel the organisation or extended validation process takes place and the customer gets the external-account-binding mac and kid if this process completes successfully. After configuring mac and kid at the ACME client, a renewal could seamlessly upgrade the DV certificate to an OV or even EV one. Vice versa a OV or EV certificate could be downgraded to a free DV certificate if the customer cancels his contract or updated validation documents are not provided in time, preventing the usage of an expired certificate. Of course, the CN and the SANs MUST NOT be altered by the CA. Regards, Oliver Weyhm=C3=BCller On Thu, Aug 17, 2017 at 5:05 PM Richard Barnes wrote: > Yeah, I agree that the intent here is for the CSR to match the certificat= e > in all material respects. > > This does require the client to know what it wants, so it knows what to > put in the CSR. Do you have a use case where that's not the case? > > On Thu, Aug 17, 2017 at 9:54 AM, Salz, Rich wrote: > >> >> It's unclear to me whether an ACME CA is allowed to issue a cert wit= h >> a superset of identifiers that were requested in the order. I see th= e >> language: >> >> > The server MUST return an error if it cannot fulfill the request a= s >> > specified, and MUST NOT issue a certificate with contents other th= an >> > those requested. >> >> The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are requ= ired to be true. >> So if you ask for A B and you are given A B C then the server was not >> compliant. > > -- Oliver Weyhm=C3=BCller Hauptstr. 17/1 73098 Rechberghausen Germany Tel +49 7161 9866330 Fax +49 7161 9866332 Mobile +49 160 1560508 E-Mail oliver@weyhmueller.de Web: https://www.weyhmueller.de --94eb2c1cbbf46889dc0556f63f7b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

I work at a "legacy CA"= ; and there it is quite common to substitute all components of the certific= ate subject except the CN when a DV certificate is issued. Also OV and EV c= ertificates normally include information in the subject, that are not part = of the requesting CSR.

We think about implementing ACME,= and see some potential use cases for that. For example, a customer's o= rder could only specify a CN in the subject to get a free DV certificate ju= st like LE does. In parallel the organisation or extended validation proces= s takes place and the customer gets the external-account-binding mac and ki= d if this process completes successfully. After configuring mac and kid at = the ACME client, a renewal could seamlessly upgrade the DV certificate to a= n OV or even EV one. Vice versa a OV or EV certificate could be downgraded = to a free DV certificate if the customer cancels his contract or updated va= lidation documents are not provided in time, preventing the usage of an exp= ired certificate.

Of course, the CN and the=C2=A0 = SANs MUST NOT be altered by the CA.

Regar= ds,
Oliver Weyhm=C3=BCller

On Thu, Aug 17, 2017 at 5:05 PM Richard Barnes <rlb@= ipv.sx> wrote:
=
Yeah, I agree that the intent here is for the CSR to match the certifi= cate in all material respects.

This does require t= he client to know what it wants, so it knows what to put in the CSR.=C2=A0 = Do you have a use case where that's not the case?

On Thu, Aug 17, 2017 at= 9:54 AM, Salz, Rich <rsalz@akamai.com> wrote:

=C2=A0 =C2=A0 It's unclear to me whether an ACME CA is allowed to issue= a cert with
=C2=A0 =C2=A0 a superset of identifiers that were requested in the order. I= see the
=C2=A0 =C2=A0 language:

=C2=A0 =C2=A0 > The server MUST return an error if it cannot fulfill the= request as
=C2=A0 =C2=A0 > specified, and MUST NOT issue a certificate with content= s other than
=C2=A0 =C2=A0 > those requested.

The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are = required to be true.=C2=A0 So if you ask for A B and you are given A B C th= en the server was not compliant.
--
Oliver Weyhm=C3=BCller
Hauptstr. 17/1
73098 Rechber= ghausen
Germany

Tel +49 7161 9866330
=
Fax +49 7161 9866332
Mobile +49 160 1560508
E-Mail=C2=A0<= a href=3D"mailto:oliver@weyhmueller.de">oliver@weyhmueller.de=C2=A0
--94eb2c1cbbf46889dc0556f63f7b-- From nobody Thu Aug 17 11:11:58 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B59091324D2 for ; Thu, 17 Aug 2017 11:11:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9FpDQO1_VCcz for ; Thu, 17 Aug 2017 11:11:54 -0700 (PDT) Received: from mail-qt0-x22b.google.com (mail-qt0-x22b.google.com [IPv6:2607:f8b0:400d:c0d::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DB821324BE for ; Thu, 17 Aug 2017 11:11:54 -0700 (PDT) Received: by mail-qt0-x22b.google.com with SMTP id t37so41916002qtg.5 for ; Thu, 17 Aug 2017 11:11:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OEfMzElzDb0JsfLjrU0sAhOA5v3xqalZCZJgjzlXIAI=; b=NxX2B8xj+nsaW9PZK5mUlf5u7mU0789EYWec4OZz78rezEGnvgWJrGhXCbTnXZarrB mupYeKGgBeQ3EmP494y84A1PkfYoSglZz3+pxslbEZjKu3WDZ/i0cubaxUzSG8ZsWuFx ORLulZlhVZVD5U8fAZ9WR4AAxm0oIBnkftTzW6CG+Fj3w17OUCAX7N5PBpqO1wkyFUrK DYvHxMKIlbncYMr7awVah4Suu42Zww0jr5mFEijISW1r+2zq3kRMZnnrXWPgKoeYyQ9O 3NGzUtXJnSPshu202QT0b+d1MMaNnVx0GxJRoL5j5OjzQn/UYjQ7tWolU7JugrkJUPy6 0h5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OEfMzElzDb0JsfLjrU0sAhOA5v3xqalZCZJgjzlXIAI=; b=Uz1GJK3X7u4uFwl9i9+GqYQcSqVETHRJzxs+mD1XYsv+McAk3rGWuKoZQhs8DhpNTc sGN1QaiEbySjVZegVzBSTzSr2RLUqmMtMf7KMHcbjvC4sHj5lpPhIVRXbM4WILLz9flv C9FvKrTzlF/9gbn2JUTDMN51/wLEOrDdxuDmMf+XNjQ+1WQcjyblZaxEfGAs+vdLVrrT Me4pesBDnP7oFzJfPIRJHC717JsOuSynk24ct35LcyxKyanH5j3lfPAgwcAIY8wIOdZH 5ZIHMg8zHkufbrO2LuS1cPG4t8L4Mi8+w40cd1vI3wZBdyIDAL/82DTc6PcW0QTLOlQz eQfA== X-Gm-Message-State: AHYfb5hIEXUsPZPV0dh5Xo9NA17SQtzMFXlW3BXW+0gRWEqTmTswn859 TtNhWaPocgZp9MIQENSz+wNK8Q3Jzg== X-Received: by 10.200.47.93 with SMTP id k29mr9032163qta.18.1502993512980; Thu, 17 Aug 2017 11:11:52 -0700 (PDT) MIME-Version: 1.0 References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> In-Reply-To: From: Clint Wilson Date: Thu, 17 Aug 2017 18:11:41 +0000 Message-ID: To: =?UTF-8?Q?Oliver_Weyhm=C3=BCller?= , Richard Barnes , "Salz, Rich" Cc: Mike Danese , "acme@ietf.org" Content-Type: multipart/alternative; boundary="001a11356e5470e6130556f6f272" Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 18:11:57 -0000 --001a11356e5470e6130556f6f272 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Oliver's use-case is very similar to our own, as well. Looking exclusively at OV, for example, it's difficult to rely upon exactly what is in the CSR for issuance. While a requester knows the specific dNSName value(s) they need, they often don't know the specific legally registered entity name. As I'm interpreting the word and intent correctly, then if a request has A, B, and O, but the provided O value in the request is not reflective of the legal entity to be represented in the certificate's O value, the CA is unable to issue the cert because they cannot assert O, but they also cannot change O to O'. Or if the request includes the Organization name and Country, but not the Locality, the CA is unable to issue the cert through ACME. On Thu, Aug 17, 2017 at 11:25 AM Oliver Weyhm=C3=BCller wrote: > Hello, > > I work at a "legacy CA" and there it is quite common to substitute all > components of the certificate subject except the CN when a DV certificate > is issued. Also OV and EV certificates normally include information in th= e > subject, that are not part of the requesting CSR. > > We think about implementing ACME, and see some potential use cases for > that. For example, a customer's order could only specify a CN in the > subject to get a free DV certificate just like LE does. In parallel the > organisation or extended validation process takes place and the customer > gets the external-account-binding mac and kid if this process completes > successfully. After configuring mac and kid at the ACME client, a renewal > could seamlessly upgrade the DV certificate to an OV or even EV one. Vice > versa a OV or EV certificate could be downgraded to a free DV certificate > if the customer cancels his contract or updated validation documents are > not provided in time, preventing the usage of an expired certificate. > > Of course, the CN and the SANs MUST NOT be altered by the CA. > > Regards, > Oliver Weyhm=C3=BCller > > On Thu, Aug 17, 2017 at 5:05 PM Richard Barnes wrote: > >> Yeah, I agree that the intent here is for the CSR to match the >> certificate in all material respects. >> >> This does require the client to know what it wants, so it knows what to >> put in the CSR. Do you have a use case where that's not the case? >> >> On Thu, Aug 17, 2017 at 9:54 AM, Salz, Rich wrote: >> >>> >>> It's unclear to me whether an ACME CA is allowed to issue a cert wi= th >>> a superset of identifiers that were requested in the order. I see t= he >>> language: >>> >>> > The server MUST return an error if it cannot fulfill the request = as >>> > specified, and MUST NOT issue a certificate with contents other >>> than >>> > those requested. >>> >>> The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are req= uired to be >>> true. So if you ask for A B and you are given A B C then the server wa= s >>> not compliant. >> >> -- > Oliver Weyhm=C3=BCller > Hauptstr. 17/1 > 73098 Rechberghausen > Germany > > Tel +49 7161 9866330 <+49%207161%209866330> > Fax +49 7161 9866332 <+49%207161%209866332> > Mobile +49 160 1560508 <+49%20160%201560508> > E-Mail oliver@weyhmueller.de > Web: https://www.weyhmueller.de > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > --001a11356e5470e6130556f6f272 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Oliver's use-case is very similar to our own, as well.= Looking exclusively at OV, for example, it's difficult to rely upon ex= actly what is in the CSR for issuance. While a requester knows the specific= dNSName value(s) they need, they often don't know the specific legally= registered entity name.

As I'm interpreting the wor= d and intent correctly, then if a request has A, B, and O, but the provided= O value in the request is not reflective of the legal entity to be represe= nted in the certificate's O value, the CA is unable to issue the cert b= ecause they cannot assert O, but they also cannot change O to O'. Or if= the request includes the Organization name and Country, but not the Locali= ty, the CA is unable to issue the cert through ACME.


On Thu, Aug 17, 2017 at= 11:25 AM Oliver Weyhm=C3=BCller <oliver@weyhmueller.de> wrote:
Hello,

I work at a "legacy CA= " and there it is quite common to substitute all components of the cer= tificate subject except the CN when a DV certificate is issued. Also OV and= EV certificates normally include information in the subject, that are not = part of the requesting CSR.

We think about implementing = ACME, and see some potential use cases for that. For example, a customer= 9;s order could only specify a CN in the subject to get a free DV certifica= te just like LE does. In parallel the organisation or extended validation p= rocess takes place and the customer gets the external-account-binding mac a= nd kid if this process completes successfully. After configuring mac and ki= d at the ACME client, a renewal could seamlessly upgrade the DV certificate= to an OV or even EV one. Vice versa a OV or EV certificate could be downgr= aded to a free DV certificate if the customer cancels his contract or updat= ed validation documents are not provided in time, preventing the usage of a= n expired certificate.

Of course, the CN and the= =C2=A0 SANs MUST NOT be altered by the CA.

Regards,
Oliver Weyhm=C3=BCller

On = Thu, Aug 17, 2017 at 5:05 PM Richard Barnes <rlb@ipv.sx> wrote:
Yeah, I agree that= the intent here is for the CSR to match the certificate in all material re= spects.

This does require the client to know what = it wants, so it knows what to put in the CSR.=C2=A0 Do you have a use case = where that's not the case?
On Thu, Aug 17, 2017 at 9:54 AM, Salz, Rich <r= salz@akamai.com> wrote:

=C2=A0 =C2=A0 It's unclear to me whether an ACME CA is allowed to issue= a cert with
=C2=A0 =C2=A0 a superset of identifiers that were requested in the order. I= see the
=C2=A0 =C2=A0 language:

=C2=A0 =C2=A0 > The server MUST return an error if it cannot fulfill the= request as
=C2=A0 =C2=A0 > specified, and MUST NOT issue a certificate with content= s other than
=C2=A0 =C2=A0 > those requested.

The =E2=80=9Cand MUST NOT=E2=80=9D clause means that both parts are = required to be true.=C2=A0 So if you ask for A B and you are given A B C th= en the server was not compliant.
--
Oliver Weyhm=C3=BCller
Hauptstr. 17/1
73098 Rechberghausen
Germany

Tel <= a href=3D"tel:+49%207161%209866330" value=3D"+4971619866330" target=3D"_bla= nk">+49 7161 9866330
= Mobile +49 160 1560508
E-Mail=C2=A0oliver@weyhmueller.de=C2=A0
_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme
--001a11356e5470e6130556f6f272-- From nobody Thu Aug 17 11:26:51 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A592B132376 for ; Thu, 17 Aug 2017 11:26:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z6SInVxuYTX7 for ; Thu, 17 Aug 2017 11:26:48 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [67.231.149.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D0DEE1325DD for ; Thu, 17 Aug 2017 11:26:48 -0700 (PDT) Received: from pps.filterd (m0122332.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7HIGXtV017261; Thu, 17 Aug 2017 19:26:45 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=hXdEqjcGI1TjVrkvVxapmhADbc3ZvHdtjrbhT4PniPs=; b=Zxl98D53QJBI6UI+Vtw7KwaeSmMR7Tuq2aVfa3kShzBNMkl3Sc6FUbh6qgDK3z71uVcW +sRoSPR1OcLDT3ntuspfjCgasqut3DQRSMxDzLkFYyA1GozNr4F7KPL3H/QsArayNePv lEpdKxWQo1Udj8ouLMdcg2yJv8IW5s2YwNwZzExMGCvrtl8cCKkkqgiid+vcOBfW1Ey7 uUN0Exu+0A4d+v7EaR1fvTfPAE3JbbX+JnOxqA7rnRGJ9ZJt8mY+VFMKzFOFZRSM4FbA iVhbeRQe2j/m88K124JoMFa10eAU2Oa2nMuim1V63zpY21UisCprJmbx0zMH3H+RrxW/ FA== Received: from prod-mail-ppoint4 ([96.6.114.87]) by mx0a-00190b01.pphosted.com with ESMTP id 2cc6dtxxey-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 19:26:45 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7HIQFnn015395; Thu, 17 Aug 2017 14:26:44 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint4.akamai.com with ESMTP id 2cc6cxdvtu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 14:26:44 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb6.msg.corp.akamai.com (172.27.123.65) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 17 Aug 2017 11:26:43 -0700 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Thu, 17 Aug 2017 14:26:42 -0400 From: "Salz, Rich" To: Clint Wilson , =?utf-8?B?T2xpdmVyIFdleWhtw7xsbGVy?= , Richard Barnes CC: Mike Danese , "acme@ietf.org" Thread-Topic: [Acme] Issuing a cert with a superset of requested identifiers Thread-Index: AQHTF2o3zOyDsJax/EWoMa7KJn2AZKKJDsoAgAAN/ID//8EjgA== Date: Thu, 17 Aug 2017 18:26:42 +0000 Message-ID: References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.43.31] Content-Type: multipart/alternative; boundary="_000_DCCC94E6362749898CFBDCEA267D3426akamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170300 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170299 Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 18:26:51 -0000 --_000_DCCC94E6362749898CFBDCEA267D3426akamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlcmXigJlzIGNvbXBsaWFudCBhbmQgdGhlcmXigJlzIGNvbXBsaWFudC4g4pi6ICBUaGUgSUVU RiBoYXMgbm8gcHJvdG9jb2wgcG9saWNlLCBhbmQgeW91IHdpbGwgbm90IGdldCBhIHRpY2tldCBm b3IgaXNzdWluZyBhIGNlcnQg4oCcd3JvbmdseS7igJ0gIFdpbGwgYW55b25lIGNvbXBsYWluIGlm IHlvdSBjaGFuZ2UgdGhlIENTUiB0byBzYXkg4oCcUy5BLuKAnSBvciDigJxQdHnigJ0gaW5zdGVh ZCBvZiDigJxJbmPigJ0gb3Ig4oCcTHRk4oCdPyAgT2YgY291cnNlIG5vdC4NCg0KV2lsbCBwZW9w bGUgYmUgdXBzZXQgaWYgeW91IGFkZCBvdGhlciByYW5kb20gU0FOIGZpZWxkcyB0aGV5IGRpZG7i gJl0IHdhbnQgb3IgYXNrIGZvcj8gIFllcy4gIFRoaXMgaXMgdGhlIGludGVybmV0LCBzb21lb25l IGlzIGJvdW5kIHRvIGJlIHVwc2V0LiDimLoNCg0KSXTigJlzIGdyZWF0IHRvIHNlZSBjb21tZXJj aWFsIGludGVyZXN0LiAgSWYgdGhlcmUgYXJlIHJlYWwgcm9hZGJsb2NrcyB3ZSBjYW4gaXNzdWUg ZXJyYXRhLCB1cGRhdGVzLCBuZXcgY2hhbGxlbmdlcywgb3Igd2hhdGV2ZXIgaXQgdGFrZXMuDQoN CiAgICAgICAgICAgICAgICAvciQNCg0KDQo= --_000_DCCC94E6362749898CFBDCEA267D3426akamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAg MCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsN CglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1p bHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBE ZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0K CXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCmE6bGluaywgc3Bhbi5Nc29IeXBl cmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNv cmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7DQoJY29sb3I6d2luZG93dGV4dDt9DQpz cGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCgltc28tc3R5bGUtbmFt ZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lOw0KCWNvbG9yOnRlYWw7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBw dDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEu MGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2Vj dGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGJnY29sb3I9IndoaXRlIiBsYW5n PSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2Vj dGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+VGhlcmXigJlzIGNvbXBsaWFudCBhbmQgdGhlcmXigJlz IGNvbXBsaWFudC4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZh bWlseTpXaW5nZGluZ3MiPko8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7IFRoZSBJRVRGIGhhcyBubyBwcm90b2NvbCBwb2xpY2Us IGFuZCB5b3Ugd2lsbCBub3QgZ2V0IGEgdGlja2V0IGZvciBpc3N1aW5nIGEgY2VydCDigJx3cm9u Z2x5LuKAnSZuYnNwOyBXaWxsIGFueW9uZSBjb21wbGFpbiBpZiB5b3UgY2hhbmdlIHRoZSBDU1IN CiB0byBzYXkg4oCcUy5BLuKAnSBvciDigJxQdHnigJ0gaW5zdGVhZCBvZiDigJxJbmPigJ0gb3Ig 4oCcTHRk4oCdPyZuYnNwOyBPZiBjb3Vyc2Ugbm90LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFt aWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmki PldpbGwgcGVvcGxlIGJlIHVwc2V0IGlmIHlvdSBhZGQgb3RoZXIgcmFuZG9tIFNBTiBmaWVsZHMg dGhleSBkaWRu4oCZdCB3YW50IG9yIGFzayBmb3I/Jm5ic3A7IFllcy4mbmJzcDsgVGhpcyBpcyB0 aGUgaW50ZXJuZXQsIHNvbWVvbmUgaXMgYm91bmQgdG8gYmUgdXBzZXQuDQo8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6V2luZ2RpbmdzIj5KPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OkNhbGlicmkiPkl04oCZcyBncmVhdCB0byBzZWUgY29tbWVyY2lhbCBpbnRlcmVz dC4mbmJzcDsgSWYgdGhlcmUgYXJlIHJlYWwgcm9hZGJsb2NrcyB3ZSBjYW4gaXNzdWUgZXJyYXRh LCB1cGRhdGVzLCBuZXcgY2hhbGxlbmdlcywgb3Igd2hhdGV2ZXIgaXQgdGFrZXMuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQ7Zm9udC1mYW1pbHk6Q2FsaWJyaSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6Q2FsaWJyaSI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC9yJDxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OkNhbGlicmkiPjxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxl ZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1s ZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_DCCC94E6362749898CFBDCEA267D3426akamaicom_-- From nobody Thu Aug 17 13:15:47 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB28B132685 for ; Thu, 17 Aug 2017 13:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HYDcepUD7XZ4 for ; Thu, 17 Aug 2017 13:15:44 -0700 (PDT) Received: from mail-vk0-x233.google.com (mail-vk0-x233.google.com [IPv6:2607:f8b0:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAA0C132678 for ; Thu, 17 Aug 2017 13:15:43 -0700 (PDT) Received: by mail-vk0-x233.google.com with SMTP id r199so26138867vke.4 for ; Thu, 17 Aug 2017 13:15:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=UTe7OGk36uuyiXAibKcNGX8tqCord72Dv+6E4lNPjwc=; b=QFBiWNk2zno3jelfx77C+gHVBcdkPuvFAl8Vc10DWD6n5coKfJMlROde8WVNYrvkGC H89cLyhV/pMKzCYZSQB7DMvhFaM4JpM1pjVi+0DhWDXnYzyNyeI1wODi7SPcfHeNFV8n O1ncH4/37axvzW8adwYbNzy4XhZ5oQqPoso8KcH4zqB3YM/fDnX0VQu4f83UvKOzbqvi ZRR2HyECNkz0tZSNNuyYR7uXUu/L6Cb5CCrRh1xltzPn6Fc9Put1Vmc7bBUeu4mb8RRR ZkD33OTRM6qAevNSaQz4qTqj/e4bwde4kIGd9W7cFNuBqDqSk1LmHc6RiogD7qsnG1t6 ET8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=UTe7OGk36uuyiXAibKcNGX8tqCord72Dv+6E4lNPjwc=; b=ITB4PVL2Vno5oRp/IgvP5Srxi5hB6vqJf2ZMZpUI18jUwcDBYXqUwLtkhJl962cleZ qjXN6Y4s2hiu9oGQ8ZaKycrSMzKOqcIYdHK/t1YKAkjfjp4hnqZZRzilTVIHIf4UmzOl tUrESyZBz1DIZ45zosXcuevghJuUcOQLz4d4C9ggYAQrApqbNK57FgChjljZyj9Uq5YN ori6r8OuIIzttQR6sSIqX5HGKOED2ZV0bosNa+eNQiVwfYahFwSrtaGneVKJTN2gXtxt 0N1IFkzqkiKCInCPXcgd2Poe1esI76DuzDQAzY2VWWmbJsCbwqtcOgElyBG7YgZEqRQV tgQg== X-Gm-Message-State: AHYfb5g/Dwu4uVwim46jZIN4gIGTgRnnjivkC3tqCsG69ipoIeehpEsB g43mTYyD+Q/jZmSsGJlP7u/magkvm4mo X-Received: by 10.31.193.141 with SMTP id r135mr4114967vkf.113.1503000942713; Thu, 17 Aug 2017 13:15:42 -0700 (PDT) MIME-Version: 1.0 Received: by 10.176.83.130 with HTTP; Thu, 17 Aug 2017 13:15:02 -0700 (PDT) In-Reply-To: References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> From: Mike Danese Date: Thu, 17 Aug 2017 13:15:02 -0700 Message-ID: To: "Salz, Rich" Cc: Clint Wilson , =?UTF-8?Q?Oliver_Weyhm=C3=BCller?= , Richard Barnes , "acme@ietf.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 20:15:46 -0000 *Resending after joining the list.* Thanks for clarifying that for me. It's the answer I expected. I have a very different use case which I believe has gotten somewhat less attention than the public CA use case. I am studying large orchestration systems (some internal and some external like Kubernetes) that have very similar APIs to ACME. In these systems, the CAs are not publicly trusted. All communication secured by these CAs is internal. These APIs are used to provide credentials to processes running in the system. Processes use these credentials to establish (essentially) mutual TLS authentication with other processes. In these systems, there is a very loose coupling between the process and the TCP loadbalancers that might front the process. A process exposes a secured network endpoint and doesn't know or care where connections are coming from. A process only knows it's own identifier. This poses a problem when trying to talk to a process through a named loadbalancer. Standard TLS validation will fail if a client talks through a named loadbancer to a process that presents a certificate with a DN of the process's identifier and without a SAN of the loadbalancer identifier. Possible solutions I can think of are: 1. Have the CA add SANs to the process's CSR for the loadbalancer identifiers the process backs. This is out of ACME spec, but we aren't going to get a ticket :) 2. Have the process fetch which loadbalancer identifiers it will back before building and sending a CSR to ACME. This has some performance implications. We like processes to start rapidly. This has some architecture implications. The loose coupling is quite handy. 3. Terminate/re-establish TLS in the loadbalancers. This has some performance and security implications. 4. Relax TLS and have processes consult a central, trusted map of loadbalancer identifiers to process identifiers to validate server authentication. This solves the problem and has some other nice properties but is (fairly radically) out of TLS spec. One of these solutions is less bad than the others and we can figure out how to workaround if we decide ACME satisfies this use case. On Thu, Aug 17, 2017 at 11:26 AM, Salz, Rich wrote: > There=E2=80=99s compliant and there=E2=80=99s compliant. J The IETF has = no protocol police, > and you will not get a ticket for issuing a cert =E2=80=9Cwrongly.=E2=80= =9D Will anyone > complain if you change the CSR to say =E2=80=9CS.A.=E2=80=9D or =E2=80=9C= Pty=E2=80=9D instead of =E2=80=9CInc=E2=80=9D or > =E2=80=9CLtd=E2=80=9D? Of course not. > > > > Will people be upset if you add other random SAN fields they didn=E2=80= =99t want or > ask for? Yes. This is the internet, someone is bound to be upset. J > > > > It=E2=80=99s great to see commercial interest. If there are real roadblo= cks we can > issue errata, updates, new challenges, or whatever it takes. > > > > /r$ > > > > From nobody Thu Aug 17 13:21:51 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D413132670 for ; Thu, 17 Aug 2017 13:21:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OcjIW2PasNJn for ; Thu, 17 Aug 2017 13:21:47 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [67.231.149.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1AE013228D for ; Thu, 17 Aug 2017 13:21:47 -0700 (PDT) Received: from pps.filterd (m0122332.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7HKHBWY007794; Thu, 17 Aug 2017 21:21:44 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=nk1fmR8UEYTEveky3X7egxznbU6MyX2C0bo20PkAG9w=; b=ICMBVichx/xs9mMW19t5LoYPZn7o4BPwQqkrFC/wk74KMmaXpGLpScAYzKJoufhlENBJ HVBnshZmqcM5PdxAcJo6IZPbEDtgwKb+k3/3kBpv337PLVzKmCUiGoK8SHxR0SGO4hG2 1nFy0sNph6AWMQBEVpYiyGijd9icx5Um0zUMutgQLDQxaaSRSZ3/ldH7IKNGgtkFvJ1w Q5du05LpNVljya6gmjQ30W/yBe3nwDHJtczuiNpV0fx0GjR8hB1uLP3Cb+nfzmUuREEO P5hqyDjqWci7stZbs5TeIZ9sbQzcrBc4RO4F/RqsAlrHxDzmZYD3dSXIO/N6Vb4+N6Qx wg== Received: from prod-mail-ppoint4 ([96.6.114.87]) by mx0a-00190b01.pphosted.com with ESMTP id 2cc6dty83k-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 21:21:44 +0100 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7HKLIfb027190; Thu, 17 Aug 2017 16:21:43 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.32]) by prod-mail-ppoint4.akamai.com with ESMTP id 2cc6cxe718-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 17 Aug 2017 16:21:43 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 17 Aug 2017 16:21:42 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Thu, 17 Aug 2017 16:21:41 -0400 From: "Salz, Rich" To: Mike Danese CC: Clint Wilson , =?utf-8?B?T2xpdmVyIFdleWhtw7xsbGVy?= , Richard Barnes , "acme@ietf.org" Thread-Topic: [Acme] Issuing a cert with a superset of requested identifiers Thread-Index: AQHTF2o3zOyDsJax/EWoMa7KJn2AZKKJDsoAgAAN/ID//8EjgIAAYVQA//++y4A= Date: Thu, 17 Aug 2017 20:21:41 +0000 Message-ID: References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.43.31] Content-Type: text/plain; charset="utf-8" Content-ID: <515184901A6B0D40A3BEB81C345D43E0@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170328 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-17_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708170327 Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Aug 2017 20:21:50 -0000 VXNlICMxIOKAkyBhZGQgdGhlIGxvYWRiYWxhbmNlciB0byB0aGUgU0FOIG5hbWUg4oCTIGFuZCB1 c2UgQUNNRSDimLoNCiANCg0K From nobody Thu Aug 17 21:29:39 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61868132626 for ; Thu, 17 Aug 2017 21:29:38 -0700 (PDT) X-Quarantine-ID: X-Virus-Scanned: amavisd-new at amsl.com X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char C3 hex): Cc: Oliver Weyhm\303\274ller ; Thu, 17 Aug 2017 21:29:35 -0700 (PDT) Received: from bigsvr.orionnetworks.ie (hosting.orionnetworks.ie [195.2.202.63]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D42F1321D2 for ; Thu, 17 Aug 2017 21:29:34 -0700 (PDT) Received: from host249.freudenhaus.alandoherty.net ([193.120.128.249]:1974 helo=alans-p4.alandoherty.net) by bigsvr.orionnetworks.ie with esmtpsa(TLSv1:DHE-RSA-AES256-SHA:256) (auth-as tel1) (nexus 1.3.4.80.1) (envelope-from ) id 1diYuP-0003q1-CE ; Fri, 18 Aug 2017 04:29:29 +0000 X-AD-RPFS-HEAD: for info on below codes http://www.alandoherty.net/mailsystem/mail-tagging/ X-AD-RPFS-GOOD-0: AV-SCAN-PASS SA-SCORE--1.6 SA-BAR-(-) X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Fri, 18 Aug 2017 05:29:18 +0100 To: Mike Danese ,"Salz, Rich" From: Alan Doherty Cc: Oliver Weyhmüller ,Richard Barnes , "acme@ietf.org" ,Clint Wilson In-Reply-To: References: <189AE4A2-495B-44C2-80E5-216488A48CC8@akamai.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit Message-Id: X-VIRUS: NONE {no virus found, This is no guarentee} Archived-At: Subject: Re: [Acme] Issuing a cert with a superset of requested identifiers X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 18 Aug 2017 04:29:38 -0000 surely public loadbalancer with acme SAN loadbalancer process with its own internal cert thus 2 separate connections same as would be used if internal process was http without ssl (aka 3) or if as you imply internal ssl is unvalidated (process names are not known to callers thus CA trusted but individual identity unvalidated) then simply obtain SAN from LE (via loadbalancer) have each process(that can be externally reached) only use a copy of this SAN+private-key have all internal callers trust this SAN (via trusting its CA as well as the internal) as it will be equally unvalidated for internal callers but will match all public names for external (validating) callers (web browsers) At 21:15 17/08/2017 Thursday, Mike Danese wrote: >*Resending after joining the list.* Thanks for clarifying that for me. It's the answer I expected. I have a very different use case which I believe has gotten somewhat less attention than the public CA use case. I am studying large orchestration systems (some internal and some external like Kubernetes) that have very similar APIs to ACME. In these systems, the CAs are not publicly trusted. All communication secured by these CAs is internal. These APIs are used to provide credentials to processes running in the system. Processes use these credentials to establish (essentially) mutual TLS authentication with other processes. In these systems, there is a very loose coupling between the process and the TCP loadbalancers that might front the process. A process exposes a secured network endpoint and doesn't know or care where connections are coming from. A process only knows it's own identifier. This poses a problem when trying to talk to a process through a named loadbalancer. Standar d TLS validation will fail if a client talks through a named loadbancer to a process that presents a certificate with a DN of the process's identifier and without a SAN of the loadbalancer identifier. Possible solutions I can think of are: 1. Have the CA add SANs to the process's CSR for the loadbalancer identifiers the process backs. This is out of ACME spec, but we aren't going to get a ticket :) 2. Have the process fetch which loadbalancer identifiers it will back before building and sending a CSR to ACME. This has some performance implications. We like processes to start rapidly. This has some architecture implications. The loose coupling is quite handy. 3. Terminate/re-establish TLS in the loadbalancers. This has some performance and security implications. 4. Relax TLS and have processes consult a central, trusted map of loadbalancer identifiers to process identifiers to validate server authentication. This solves the problem and has some other nice properties but is (fairly radically) out of TLS spec. One of these solutions is less bad than the others and we can figure out how to workaround if we decide ACME satisfies this use case. On Thu, Aug 17, 2017 at 11:26 AM, Salz, Rich wrote: > There’s compliant and there’s compliant. J The IETF has no protocol police, > and you will not get a ticket for issuing a cert “wrongly.” Will anyone > complain if you change the CSR to say “S.A.” or “Pty” instead of “Inc” or > “Ltd”? Of course not. > > > > Will people be upset if you add other random SAN fields they didn’t want or > ask for? Yes. This is the internet, someone is bound to be upset. J > > > > It’s great to see commercial interest. If there are real roadblocks we can > issue errata, updates, new challenges, or whatever it takes. > > > > /r$ > > > > _______________________________________________ Acme mailing list Acme@ietf.org https://www.ietf.org/mailman/listinfo/acme From nobody Thu Aug 24 09:09:26 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAB941201F8 for ; Thu, 24 Aug 2017 09:09:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=letsencrypt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YlK_x3UyjTZB for ; Thu, 24 Aug 2017 09:09:21 -0700 (PDT) Received: from mail-it0-x231.google.com (mail-it0-x231.google.com [IPv6:2607:f8b0:4001:c0b::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 170D2132335 for ; Thu, 24 Aug 2017 09:09:21 -0700 (PDT) Received: by mail-it0-x231.google.com with SMTP id f135so5068567ita.0 for ; Thu, 24 Aug 2017 09:09:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=letsencrypt.org; s=google; h=mime-version:reply-to:from:date:message-id:subject:to; bh=9z8ZCxmSz207YHcKxY0kggjsKM0etgJt8ClKz8g4V44=; b=fQwAG43eruXiDavoskeoNUjYbSaKT0/yrqwiodGq8Iw+WLx/JjP8gz1g90MeRunHhV 38t7hohwEaUL8heRgBaeYSp4RXoQmZrMEtQVluv3lBZUuoYdtgZcQH38s0YlZZ2Kde9z uyYpfNwjqA5T577dxFA24iIlp8kQpq8fBs758= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:from:date:message-id :subject:to; bh=9z8ZCxmSz207YHcKxY0kggjsKM0etgJt8ClKz8g4V44=; b=cgf8gvpC5bcmlhs6k4rpr8GiPT74ZKeUhZeyqjPY2/ZYiJtQWbwpVMqgqpZ5Z0cGDw ArSws/04OgmMHitmjunmF8srmHzfPzhmzXzLAZtaadl3K/daTJHeDfcN7BAPrQKc5YcS eX3i4vhaGStSlvzDqDY1KvHKw9EHPwl+ZyeAlEUnPTyxmny2bwrqjvdRGvzW2IjWm/ul tuHXd3N1SmOG8F9QjQFsBzl1HvtU9FAzx1hdjpaz5ut/UH98PoxK8L7dD1rj6Fcj5Wlm cLPDPCNvauNbjUV3tEUYD7BOM8VcV4vDA6WJcsyclJN0sfkXU11/MaAXMQ3MxnW66SJG ljsw== X-Gm-Message-State: AHYfb5ge2aW9SVzniCDcusAIf7HdsJMPO4WWcGQa4lWgPFN9KyLWdSra h5fA0WLaJ2HgISfkzXOwhlLs0RrMSNyNg4utVg== X-Received: by 10.36.20.200 with SMTP id 191mr6090957itg.40.1503590960326; Thu, 24 Aug 2017 09:09:20 -0700 (PDT) MIME-Version: 1.0 Reply-To: cpu@letsencrypt.org Received: by 10.107.162.130 with HTTP; Thu, 24 Aug 2017 09:09:19 -0700 (PDT) From: Daniel McCarney Date: Thu, 24 Aug 2017 12:09:19 -0400 Message-ID: To: IETF ACME Content-Type: multipart/alternative; boundary="001a1143d350140acc0557820d03" Archived-At: Subject: [Acme] Send "Location" header in key-rollover conflict response. X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 16:09:24 -0000 --001a1143d350140acc0557820d03 Content-Type: text/plain; charset="UTF-8" Hi folks, In 7.3.1 "Finding an Account URL Given a Key" the server returns a "Location" header populated with the account URL of the account associated with a given account key. In 7.3.6 "Account Key Roll-over", there is a similar condition in which the new key specified as part of a rollover request is already in use by an existing account. Currently the spec says a server SHOULD return status 409 (conflict) and leaves it at that. I believe for consistency sake and to save an additional round-trip to learn the account URL that the server SHOULD also return a "Location" header with the account URL for key rollovers that are in conflict. I've opened a small PR to add this wording: https://github.com/ietf-wg-acme/acme/pull/339 Thanks! - cpu --001a1143d350140acc0557820d03 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi folks,

In 7.3.1 "Finding an Account URL Giv= en a Key" the server returns a "Location" header populated w= ith the account URL of the account associated with a given account key.
=
In 7.3.6 "Account Key Roll-over", there is a similar conditio= n in which the new key specified as part of a rollover request is already i= n use by an existing account. Currently the spec says a server SHOULD retur= n status 409 (conflict) and leaves it at that.

I believe for consist= ency sake and to save an additional round-trip to learn the account URL tha= t the server SHOULD also return a "Location" header with the acco= unt URL for key rollovers that are in conflict.

I've opened a sm= all PR to add this wording:
https://github.com/ietf-wg-acme/acme/p= ull/339

Thanks!

- cpu
--001a1143d350140acc0557820d03-- From nobody Thu Aug 24 11:59:46 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADB201320D9 for ; Thu, 24 Aug 2017 11:59:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.711 X-Spam-Level: X-Spam-Status: No, score=-0.711 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=letsencrypt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HZrkc6s1AuP5 for ; Thu, 24 Aug 2017 11:59:40 -0700 (PDT) Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 360C21320CF for ; Thu, 24 Aug 2017 11:59:40 -0700 (PDT) Received: by mail-io0-x233.google.com with SMTP id g71so1259241ioe.1 for ; Thu, 24 Aug 2017 11:59:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=letsencrypt.org; s=google; h=mime-version:reply-to:in-reply-to:references:from:date:message-id :subject:to:cc; bh=eeJx/VGjcjyIuAOA+y3hRZE7aGCxiUJBgsBE6eE8puE=; b=XL+vaa9g+3k3iifIDOMdE5rrwkMcHFWL0GZrsjwJEPINqExUjlkLpnWqFgu6T0OCB8 WsDALaXh3iNur6t1V262wbh4pWt8SlSPauN//6Upnc7KugF12NW6nQi0rl8cWlqdZO4d ijy5NGCh/MUFDTwleVldqz7bK0RMoyUthSd/g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc; bh=eeJx/VGjcjyIuAOA+y3hRZE7aGCxiUJBgsBE6eE8puE=; b=L1WGdNaRVdllJGmYX4ZC3GX93iOZibuGdeEgUevUX14OI3tIwGjy83uH8CnMihvqyW 7riv9CZr2fxOM38at5VRd2cML0QREmlFykZymSzepJsxTiX3a3fNMaX6N40y/cerAOHe SiR1Ttpe0z8xHGYc+0jRHUtcNoB5JqQj66jtWs73jKyxSU+cED6vGC5rc3wbD9g6nkDo xRm8HRaJB/dL/KThMgLVQbT7moRBu05RHIpn+EfA8RglWO3AUZELQb0IMP/WMPU/6LMA wbuJPYps7OkItDVky5ctEpk0EEwUwxto2ukKsqgrwOMmgtCSXm92NXJRDsBamejDVOsA HkDw== X-Gm-Message-State: AHYfb5iA2TX8+skFnaFuKbMG9cKn5lt86nEUp2g6tov+eVrjdCxON7wr kCmCdCuehBu5tvgxDvW/TvVCJcbavU2A/1G2UA== X-Received: by 10.107.174.90 with SMTP id x87mr5662868ioe.138.1503601179570; Thu, 24 Aug 2017 11:59:39 -0700 (PDT) MIME-Version: 1.0 Reply-To: cpu@letsencrypt.org Received: by 10.107.162.130 with HTTP; Thu, 24 Aug 2017 11:59:38 -0700 (PDT) In-Reply-To: <59721cd4.4eec1c0a.fce35.8ce0@mx.google.com> References: <59721cd4.4eec1c0a.fce35.8ce0@mx.google.com> From: Daniel McCarney Date: Thu, 24 Aug 2017 14:59:38 -0400 Message-ID: To: Yoav Nir Cc: IETF ACME Content-Type: multipart/alternative; boundary="001a11445fe43147990557846e9f" Archived-At: Subject: Re: [Acme] Minutes from IEtf 99 X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 18:59:43 -0000 --001a11445fe43147990557846e9f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > > The real minutes are what we will upload in a few days or weeks, and they > are usually in plaintext form. Hi Yoav, Have the real minutes been shared anywhere? Thanks! On Fri, Jul 21, 2017 at 11:25 AM, Yoav Nir wrote: > Hi, Daniel > > > > It should be noted that Richard=E2=80=99s notes are just an aid to the ch= airs > (that's Rich and me now that Ted is moving on) > > > > The real minutes are what we will upload in a few days or weeks, and they > are usually in plaintext form. > > > > Sent from my Windows 10 phone > > > > *From: *Daniel McCarney > *Sent: *Friday, July 21, 2017 16:00 > *To: *Richard Barnes > *Cc: *Salz, Rich ; IETF ACME > *Subject: *Re: [Acme] Minutes from IEtf 99 > > > > Hi Richard, > > Thank you! No need to apologize. > > > > On Fri, Jul 21, 2017 at 9:38 AM, Richard Barnes wrote: > > Of course you're right. I apologize. I will go through the audio > recording and produce some proper notes. > > > > On Jul 21, 2017 3:32 PM, "Daniel McCarney" wrote: > > I think this is the second time (in my memory) the WG notes have been > distributed in "meme form". At the risk of being the stick in the mud I > want to express an opinion that "meme notes" are distracting and I think > the time spent producing the memes would have been better spent capturing > the content of discussions during the working group. > > I was unable to attend physically and the timezone delta made it difficul= t > to attend virtually. Looking at these notes as they exist presently hasn'= t > given me much understanding of the topics discussed. In the future could > the WG consider returning to plain old ASCII for meeting notes and sticki= ng > to the content instead of punchlines? > > > > Thanks! > > > > On Fri, Jul 21, 2017 at 7:23 AM, Salz, Rich wrote: > > Please take a look at the minutes/memes and post corrections by the next > week. > > > > Minute-taker gets to choose if he accepts changed pictures or not J > > > > -- > > Senior Architect, Akamai Technologies > > Member, OpenSSL Dev Team > > IM: richsalz@jabber.at Twitter: RichSalz > > > > *From:* Richard Barnes [mailto:rlb@ipv.sx] > *Sent:* Friday, July 21, 2017 11:02 AM > *To:* acme-chairs@tools.ietf.org > *Subject:* Memes > > > > https://docs.google.com/document/d/18zB3ZiPGpqUi23qB- > TwWD82rd7QdwDCo5WNfkX41ae8/edit > > > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > > > > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > > > > > --001a11445fe43147990557846e9f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The real minutes are what we will upload in a few = days or weeks, and they are usually in plaintext form.
<= br>Hi Yoav,

Have the real minutes been shared anywhere?

Thanks!


On Fri, Jul 21, 2017 at 11:25 AM, Yoav Nir <ynir.ietf@g= mail.com> wrote:

Hi, Daniel

=C2=A0

It should be noted that Ri= chard=E2=80=99s notes are just an aid to the chairs=C2=A0 (that's Rich = and me now that Ted is moving on)

=C2=A0

The real minutes are what we will upload in= a few days or weeks, and they are usually in plaintext form.

=C2=A0

Sent from my = Windows 10 phone

=C2=A0

From: Daniel McCarneySent: Friday, July 21, 2017 16:00
To: Richard Barnes
Cc: Salz, Rich; IETF ACME
Subject: Re: [Acme= ] Minutes from IEtf 99

=C2=A0

Hi Richard,

T= hank you! No need to apologize.

=C2=A0

On Fri, Jul 21, 2017 at 9:38 = AM, Richard Barnes <rlb@= ipv.sx> wrote:

Of course you're right. =C2=A0 I apologiz= e.=C2=A0 I will go through the audio recording and produce some proper note= s. =C2=A0

=C2=A0

On Jul 21, 2017 3:32 PM, "Daniel McC= arney" <cp= u@letsencrypt.org> wrote:

I think this is the second time (i= n my memory) the WG notes have been distributed in "meme form". A= t the risk of being the stick in the mud I want to express an opinion that = "meme notes" are distracting and I think the time spent producing= the memes would have been better spent capturing the content of discussion= s during the working group.

I was unable to attend physically and th= e timezone delta made it difficult to attend virtually. Looking at these no= tes as they exist presently hasn't given me much understanding of the t= opics discussed. In the future could the WG consider returning to plain old= ASCII for meeting notes and sticking to the content instead of punchlines?=

=C2=A0

Thanks!

= =C2=A0

On Fri, Jul 21, 2017 at 7:23 A= M, Salz, Rich <rsa= lz@akamai.com> wrote:

Please take a look at the minutes= /memes and post corrections by the next week.

=C2= =A0

Minute-taker gets to choose if he accepts cha= nged pictures or not J

=C2=A0

--=C2=A0

Senior Architect, Akamai Technologies

Member, OpenSSL Dev Team

IM: richsalz@jabber.at Twitter: Ric= hSalz

=C2=A0

From: Richard Barnes [mailto:r= lb@ipv.sx]
Sent: Friday, July 21, 2017 11:02 AM
To: acme-chai= rs@tools.ietf.org
Subject: Memes

= =C2=A0


_________________________= ______________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman= /listinfo/acme

=C2=A0


_______________________________________________
Acme mailing= list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme

=C2=A0

=C2=A0


--001a11445fe43147990557846e9f-- From nobody Thu Aug 24 12:39:55 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5F1C132031 for ; Thu, 24 Aug 2017 12:39:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.71 X-Spam-Level: X-Spam-Status: No, score=-0.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ymccVMIwCTeJ for ; Thu, 24 Aug 2017 12:39:50 -0700 (PDT) Received: from mail-wm0-x22c.google.com (mail-wm0-x22c.google.com [IPv6:2a00:1450:400c:c09::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54221126BF3 for ; Thu, 24 Aug 2017 12:39:49 -0700 (PDT) Received: by mail-wm0-x22c.google.com with SMTP id b189so3083697wmd.0 for ; Thu, 24 Aug 2017 12:39:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ONHLZFq/B6A8W2oWiaXvlQVPJln0GpKo/5yQbJCpAD8=; b=C8S+iWd8eV6TGrRJDVTshx+Y1AMgZ0fZwAacEDsuaTb/U4Si6c0jucLR4xX6fC8nDe VHUHa+/DvxD7VnoaIpeK6dw7y3wlKLU9kB66Z7nGKsJaKpfRIr9wGcrzKhwy1gNoH7sq /gkMl+pWJ2ToPUpybtKRuUDo32jEGh4Jc2LXZXSRJYOrhKeFyBddmJhrhKj13hTaUOW6 Bffd6Lr9xBkAzVFAouXXZ91vo5jU8s0/E9Zfu54SRKNUi9eDsGsamM1g0hqaddpIPC63 aLrElJmP0invqVg+/ageFwn64FsjiQddL07NLcTElQk142TszfbQfM8oDM6OGs4Po7td sQ5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ONHLZFq/B6A8W2oWiaXvlQVPJln0GpKo/5yQbJCpAD8=; b=cBZiv3/ZKArZVjVHxMAY4/xHNqsGR3isx9shPcWpDtq9Rwp7uQT60IeH0kTyim6IVI 9F86stcUmGrTSAcApwR2kgG2xX7cG3xl10QAKEkSbj+0FrTaYsCM4d+qcQbRM5o5nxnO TXic9fKEBbSyBFdgAhrRziOJC8INd4P7y5p18iHE/3nnOLhsmQEXqfPaO/R3WLIM7dVg U3orA57Od0Tzt0hGj/X+z0SacE4KHtFRQIycY5StSXzRi7vCaEcevNPV0w13reGQqoQZ 109Cqc+Diz1+5Q2Gf55y9j1fBPmZY/DpvENEtjf9RbjkQmLiAdx8RTHv4eUFsMcFX7l1 vVug== X-Gm-Message-State: AHYfb5g8hF+qa/OnAAq1IT8r2XN4C9X3pul+AqyXM3HHXctxW3mtOGHp Y+B2BTkz+7H85Q== X-Received: by 10.80.164.215 with SMTP id x23mr7337744edb.114.1503603588487; Thu, 24 Aug 2017 12:39:48 -0700 (PDT) Received: from [192.168.1.18] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id c56sm2002147eda.77.2017.08.24.12.39.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 24 Aug 2017 12:39:47 -0700 (PDT) From: Yoav Nir Message-Id: <2BD0DD60-A7CB-46A8-A241-418E11234C1A@gmail.com> Content-Type: multipart/signed; boundary="Apple-Mail=_B7843D2F-FB57-48B7-8BAD-3B5D5F00F960"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Thu, 24 Aug 2017 22:39:45 +0300 In-Reply-To: Cc: IETF ACME To: cpu@letsencrypt.org References: <59721cd4.4eec1c0a.fce35.8ce0@mx.google.com> X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [Acme] Minutes from IEtf 99 X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 19:39:53 -0000 --Apple-Mail=_B7843D2F-FB57-48B7-8BAD-3B5D5F00F960 Content-Type: multipart/alternative; boundary="Apple-Mail=_EF415675-B4DD-43DF-9C6B-56B9E7DB5723" --Apple-Mail=_EF415675-B4DD-43DF-9C6B-56B9E7DB5723 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 https://datatracker.ietf.org/meeting/99/materials/minutes-99-acme = Kind of underwhelming, I know. Rich: Are we planning on fleshing this out? Yoav > On 24 Aug 2017, at 21:59, Daniel McCarney wrote: >=20 > The real minutes are what we will upload in a few days or weeks, and = they are usually in plaintext form. >=20 > Hi Yoav, >=20 > Have the real minutes been shared anywhere? >=20 > Thanks! >=20 >=20 > On Fri, Jul 21, 2017 at 11:25 AM, Yoav Nir > wrote: > Hi, Daniel >=20 >=20 >=20 > It should be noted that Richard=E2=80=99s notes are just an aid to the = chairs (that's Rich and me now that Ted is moving on) >=20 >=20 >=20 > The real minutes are what we will upload in a few days or weeks, and = they are usually in plaintext form. >=20 >=20 >=20 > Sent from my Windows 10 phone >=20 >=20 >=20 > From: Daniel McCarney > Sent: Friday, July 21, 2017 16:00 > To: Richard Barnes > Cc: Salz, Rich ; IETF ACME = > Subject: Re: [Acme] Minutes from IEtf 99 >=20 >=20 >=20 > Hi Richard, >=20 > Thank you! No need to apologize. >=20 >=20 >=20 > On Fri, Jul 21, 2017 at 9:38 AM, Richard Barnes > wrote: >=20 > Of course you're right. I apologize. I will go through the audio = recording and produce some proper notes. >=20 >=20 >=20 > On Jul 21, 2017 3:32 PM, "Daniel McCarney" > wrote: >=20 > I think this is the second time (in my memory) the WG notes have been = distributed in "meme form". At the risk of being the stick in the mud I = want to express an opinion that "meme notes" are distracting and I think = the time spent producing the memes would have been better spent = capturing the content of discussions during the working group. >=20 > I was unable to attend physically and the timezone delta made it = difficult to attend virtually. Looking at these notes as they exist = presently hasn't given me much understanding of the topics discussed. In = the future could the WG consider returning to plain old ASCII for = meeting notes and sticking to the content instead of punchlines? >=20 >=20 >=20 > Thanks! >=20 >=20 >=20 > On Fri, Jul 21, 2017 at 7:23 AM, Salz, Rich > wrote: >=20 > Please take a look at the minutes/memes and post corrections by the = next week. >=20 >=20 > Minute-taker gets to choose if he accepts changed pictures or not J >=20 >=20 > -- >=20 > Senior Architect, Akamai Technologies >=20 > Member, OpenSSL Dev Team >=20 > IM: richsalz@jabber.at Twitter: RichSalz >=20 >=20 > From: Richard Barnes [mailto:rlb@ipv.sx ] > Sent: Friday, July 21, 2017 11:02 AM > To: acme-chairs@tools.ietf.org > Subject: Memes >=20 >=20 > = https://docs.google.com/document/d/18zB3ZiPGpqUi23qB-TwWD82rd7QdwDCo5WNfkX= 41ae8/edit = >=20 > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme = >=20 >=20 >=20 > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme = >=20 >=20 >=20 >=20 >=20 --Apple-Mail=_EF415675-B4DD-43DF-9C6B-56B9E7DB5723 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 https://datatracker.ietf.org/meeting/99/materials/minutes-99-ac= me

Kind of = underwhelming, I know.

Rich: Are we planning on fleshing this out?

Yoav

On 24 Aug 2017, at 21:59, Daniel McCarney <cpu@letsencrypt.org>= wrote:

The real minutes are what we will upload in a few days or = weeks, and they are usually in plaintext form.

Hi Yoav,

Have the real minutes = been shared anywhere?

Thanks!


On Fri, = Jul 21, 2017 at 11:25 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:

Hi, = Daniel

 

It should be noted that = Richard=E2=80=99s notes are just an aid to the chairs  (that's Rich = and me now that Ted is moving on)

 

The = real minutes are what we will upload in a few days or weeks, and they = are usually in plaintext form.

 

Sent = from my Windows 10 phone

 

From: Daniel = McCarney
Sent: Friday, July 21, 2017 = 16:00
To: Richard Barnes
Cc: Salz, Rich; IETF ACME
Subject: Re: [Acme] Minutes from IEtf 99

 

Hi Richard,

Thank you! = No need to apologize.

 

On Fri, Jul 21, 2017 at 9:38 AM, Richard Barnes = <rlb@ipv.sx> wrote:

Of course you're right.   I apologize.  I = will go through the audio recording and produce some proper notes. =  

 

On Jul 21, 2017 3:32 PM, "Daniel = McCarney" <cpu@letsencrypt.org> wrote:

I think this is the second time (in my memory) the = WG notes have been distributed in "meme form". At the risk of being the = stick in the mud I want to express an opinion that "meme notes" are = distracting and I think the time spent producing the memes would have = been better spent capturing the content of discussions during the = working group.

I was unable to attend = physically and the timezone delta made it difficult to attend virtually. = Looking at these notes as they exist presently hasn't given me much = understanding of the topics discussed. In the future could the WG = consider returning to plain old ASCII for meeting notes and sticking to = the content instead of punchlines?

 

Thanks!

 

On Fri, Jul 21, 2017 at 7:23 AM, Salz, = Rich <rsalz@akamai.com> wrote:

Please take a look at the = minutes/memes and post corrections by the next week.

 

Minute-taker gets to choose if he accepts changed = pictures or not J

 

--  =

Senior Architect, Akamai Technologies

Member, OpenSSL Dev Team

IM:= richsalz@jabber.at Twitter: RichSalz

 

From: Richard Barnes [mailto:rlb@ipv.sx] =
Sent: Friday, July 21, 2017 11:02 AM
To: acme-chairs@tools.ietf.org
Subject: Memes

 

https://docs.google.com/document/d/18zB3ZiPGpqUi23qB-TwWD82rd7QdwDCo5WNfkX41ae8/edit


_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme

 


_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme

 

 



= --Apple-Mail=_EF415675-B4DD-43DF-9C6B-56B9E7DB5723-- --Apple-Mail=_B7843D2F-FB57-48B7-8BAD-3B5D5F00F960 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJZnyuBAAoJELhJCxUKWMyZAJcH+wQAhcSKj6VJAbTmbqcZ1t01 yjky+gM7N4KqAywgfH1xh9GjN9tP0ijy710M60D68FGzVDk24fNpnnmwMjmpXPam RBpPl8W8CscAB2YewnzyiRIbGFPQqOsvzzCCwRXZgeWY8yROCdOS7e5SC7gG2ve+ EfoyF3gAHeKGHGllNl33+lskYkfYZVpk0fvJ1CWL/BKUlcF51YvzXRNQHyD0C1jS sUnKbSlF15P2E8rqfazXuAXH1IGyZq04bO2fWErwQeLy1oTzDU4sdf5B5mCjaJK+ uBOLZMRlSLdbyKdcr2Xtt+VS3QqDqC07oPVcYd/VUHn7UELXb36W0dkhdDabQaU= =R3O4 -----END PGP SIGNATURE----- --Apple-Mail=_B7843D2F-FB57-48B7-8BAD-3B5D5F00F960-- From nobody Thu Aug 24 13:06:10 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A42DC13207A for ; Thu, 24 Aug 2017 13:06:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.011 X-Spam-Level: X-Spam-Status: No, score=-0.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=letsencrypt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eaPOQLiEaBC0 for ; Thu, 24 Aug 2017 13:06:03 -0700 (PDT) Received: from mail-it0-x22b.google.com (mail-it0-x22b.google.com [IPv6:2607:f8b0:4001:c0b::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14547132113 for ; Thu, 24 Aug 2017 13:06:03 -0700 (PDT) Received: by mail-it0-x22b.google.com with SMTP id x187so2255391ite.1 for ; Thu, 24 Aug 2017 13:06:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=letsencrypt.org; s=google; h=mime-version:reply-to:in-reply-to:references:from:date:message-id :subject:to:cc; bh=l6v8/bnykcIAVTI4reuELGJ7g5KDjfVoZ1gE+w7GOxk=; b=d2wnwwBjRhzzrY3OUYINhx3ef5pEJ43EojntgVqHfCt02tzyr7pB+A9WLXBTl88BnR q6MKGLTR1GqzdUoVLibX+QXeVeBbgHU2kHAbtwzeim7KHG7uzmTZRAKFd+EkDwseQfx2 +siXHup3U5golbvekIFUJcg+4Fc9oMCY+xaGI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:reply-to:in-reply-to:references :from:date:message-id:subject:to:cc; bh=l6v8/bnykcIAVTI4reuELGJ7g5KDjfVoZ1gE+w7GOxk=; b=WAcpEei1PixkrslZE9hN3Dy4xHLPnMHEqzLoIUiwhGM76To112K6nQSCm8ux3P2Da8 rLEA6emKsJ7amQUH8rj4swh/bKnHskrM8Ip9Jpek7+MezfZlQpkTHABFqAEzBP3Awooy v94Szy8FSfaGWAO51rM7hGoZND77K1rGqFQ8pvA90UNPNA82bW4UMeY5SC75v/CDhwl/ S5WLod4NBsmM+g6N2xNOBsbtWQlbVYw/1pIBgXka0Z+30tN1oBayz2LQfLLkrB5nbFcX zMJWqHimgqov6FB6JAucP5aiq3mlab70z0R+dtgBthrZi0tM8DKqUerwlnFPwM5Lmbvt Y8Dg== X-Gm-Message-State: AHYfb5h+Y3N5DPkcvCTQ5owtCI6Vn6tLKYFCPHapDTuSAPUrD+oRXl2d XbwuNi4buUZ9sSAvfJ33F981dCSIqMax X-Received: by 10.36.69.223 with SMTP id c92mr6993344itd.153.1503605162327; Thu, 24 Aug 2017 13:06:02 -0700 (PDT) MIME-Version: 1.0 Reply-To: cpu@letsencrypt.org Received: by 10.107.162.130 with HTTP; Thu, 24 Aug 2017 13:06:01 -0700 (PDT) In-Reply-To: <2BD0DD60-A7CB-46A8-A241-418E11234C1A@gmail.com> References: <59721cd4.4eec1c0a.fce35.8ce0@mx.google.com> <2BD0DD60-A7CB-46A8-A241-418E11234C1A@gmail.com> From: Daniel McCarney Date: Thu, 24 Aug 2017 16:06:01 -0400 Message-ID: To: Yoav Nir Cc: IETF ACME Content-Type: multipart/alternative; boundary="001a11c149669557ad0557855ba2" Archived-At: Subject: Re: [Acme] Minutes from IEtf 99 X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 20:06:07 -0000 --001a11c149669557ad0557855ba2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > https://datatracker.ietf.org/meeting/99/materials/minutes-99-acme Thanks! Apologies for not finding them myself. I was looking in the wrong place. On Thu, Aug 24, 2017 at 3:39 PM, Yoav Nir wrote: > https://datatracker.ietf.org/meeting/99/materials/minutes-99-acme > > Kind of underwhelming, I know. > > Rich: Are we planning on fleshing this out? > > Yoav > > On 24 Aug 2017, at 21:59, Daniel McCarney wrote: > > The real minutes are what we will upload in a few days or weeks, and they >> are usually in plaintext form. > > > Hi Yoav, > > Have the real minutes been shared anywhere? > > Thanks! > > > On Fri, Jul 21, 2017 at 11:25 AM, Yoav Nir wrote: > >> Hi, Daniel >> >> >> >> It should be noted that Richard=E2=80=99s notes are just an aid to the c= hairs >> (that's Rich and me now that Ted is moving on) >> >> >> >> The real minutes are what we will upload in a few days or weeks, and the= y >> are usually in plaintext form. >> >> >> >> Sent from my Windows 10 phone >> >> >> >> *From: *Daniel McCarney >> *Sent: *Friday, July 21, 2017 16:00 >> *To: *Richard Barnes >> *Cc: *Salz, Rich ; IETF ACME >> *Subject: *Re: [Acme] Minutes from IEtf 99 >> >> >> >> Hi Richard, >> >> Thank you! No need to apologize. >> >> >> >> On Fri, Jul 21, 2017 at 9:38 AM, Richard Barnes wrote: >> >> Of course you're right. I apologize. I will go through the audio >> recording and produce some proper notes. >> >> >> >> On Jul 21, 2017 3:32 PM, "Daniel McCarney" wrote: >> >> I think this is the second time (in my memory) the WG notes have been >> distributed in "meme form". At the risk of being the stick in the mud I >> want to express an opinion that "meme notes" are distracting and I think >> the time spent producing the memes would have been better spent capturin= g >> the content of discussions during the working group. >> >> I was unable to attend physically and the timezone delta made it >> difficult to attend virtually. Looking at these notes as they exist >> presently hasn't given me much understanding of the topics discussed. In >> the future could the WG consider returning to plain old ASCII for meetin= g >> notes and sticking to the content instead of punchlines? >> >> >> >> Thanks! >> >> >> >> On Fri, Jul 21, 2017 at 7:23 AM, Salz, Rich wrote: >> >> Please take a look at the minutes/memes and post corrections by the next >> week. >> >> >> Minute-taker gets to choose if he accepts changed pictures or not J >> >> >> -- >> >> Senior Architect, Akamai Technologies >> >> Member, OpenSSL Dev Team >> >> IM: richsalz@jabber.at Twitter: RichSalz >> >> >> *From:* Richard Barnes [mailto:rlb@ipv.sx] >> *Sent:* Friday, July 21, 2017 11:02 AM >> *To:* acme-chairs@tools.ietf.org >> *Subject:* Memes >> >> >> https://docs.google.com/document/d/18zB3ZiPGpqUi23qB-TwWD82r >> d7QdwDCo5WNfkX41ae8/edit >> >> >> >> _______________________________________________ >> Acme mailing list >> Acme@ietf.org >> https://www.ietf.org/mailman/listinfo/acme >> >> >> >> >> _______________________________________________ >> Acme mailing list >> Acme@ietf.org >> https://www.ietf.org/mailman/listinfo/acme >> >> >> >> >> > > > --001a11c149669557ad0557855ba2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
>=C2=A0= https://datatracker.ietf.org/meeting/99/materials/minutes-99-acme=

Thanks! Apologies for not finding them myself. I was looking i= n the wrong place.

On Thu, Aug 24, 2017 at 3:39 PM, Yoav Nir &l= t;ynir.ietf@gmail.= com> wrote:
https://datatracker.ietf.org/meeting/99/materials/minutes-99-acme

Kind of u= nderwhelming, I know.

Rich: Are we planning on fle= shing this out?
Yoav

<= blockquote type=3D"cite">
On 24 Aug 2017, at 21:59, Daniel McCarney <= ;cpu@letsencrypt.o= rg> wrote:

The real minutes are what we will up= load in a few days or weeks, and they are usually in plaintext form.=

Hi Yoav,

Have the real minutes been shared anywhere= ?

Thanks!

=
On Fri, Jul 21, 2017 at 11:25 AM, Yoav Nir <= span dir=3D"ltr"><ynir.ietf@gmail.com> wrote:

Hi= , Daniel

=C2=A0

It should be noted that Richard=E2=80=99s notes are just an aid to t= he chairs=C2=A0 (that's Rich and me now that Ted is moving on)

=C2=A0

The real m= inutes are what we will upload in a few days or weeks, and they are usually= in plaintext form.

=C2=A0

Sent from my Windows 10 phone

<= u>=C2=A0

=C2=A0=

=C2=A0

=

On Fri, Jul 21, 2017 at 9:38 AM, Richard Barnes <= rlb@ipv.sx> wrote:

Of course you're right. =C2=A0 I apologize.=C2=A0 I will go thro= ugh the audio recording and produce some proper notes. =C2=A0

=C2=A0

On Jul 21, 2017 3:32 PM, "Daniel McCarney" <cpu@letsencrypt.org&g= t; wrote:

I think this is the second time (in my memory) the WG not= es have been distributed in "meme form". At the risk of being the= stick in the mud I want to express an opinion that "meme notes" = are distracting and I think the time spent producing the memes would have b= een better spent capturing the content of discussions during the working gr= oup.

I was unable to attend physically and the timezone delta made i= t difficult to attend virtually. Looking at these notes as they exist prese= ntly hasn't given me much understanding of the topics discussed. In the= future could the WG consider returning to plain old ASCII for meeting note= s and sticking to the content instead of punchlines?

=C2=A0

Thanks!<= /p>

=C2=A0

On Fri, Jul 21, 2017 at 7:23 AM, Salz, Rich <rsalz@akamai.com> wro= te:

Please take a look at the minutes/memes and post correctio= ns by the next week.

=C2=A0

Minute-taker gets to choos= e if he accepts changed pictures or not J

=C2=A0

--=C2=A0

Senior Architect, Akamai Technologies

Member, Op= enSSL Dev Team

IM: richsalz@jabber.at Twitter: RichSalz

= =C2=A0

From: Richard Barnes [mailto:rlb@ipv.sx]
Sent: Friday, July = 21, 2017 11:02 AM
To: acme-chairs@tools.ietf.org
Subject: Meme= s

=C2=A0


_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/li= stinfo/acme

=C2=A0<= u>


_= ______________________________________________
Acme mailing listAcme@ietf.org
http= s://www.ietf.org/mailman/listinfo/acme

=C2=A0<= u>

=C2=A0

=


--001a11c149669557ad0557855ba2-- From nobody Thu Aug 24 13:11:49 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7EBB1321DF for ; Thu, 24 Aug 2017 13:11:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bsKiCMd_p_iM for ; Thu, 24 Aug 2017 13:11:45 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2C10132139 for ; Thu, 24 Aug 2017 13:11:45 -0700 (PDT) Received: from pps.filterd (m0050096.ppops.net [127.0.0.1]) by m0050096.ppops.net-00190b01. (8.16.0.21/8.16.0.21) with SMTP id v7OKBgB5020978; Thu, 24 Aug 2017 21:11:42 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=DngbR2TLOuwVks3M8Vm4UtHOMu8lJDZqxxG4L8CDyqE=; b=PUj4o2tcmrWVCLAOFtg8H6CrXQfKqBPXdG5WlnNHcHCbs8U6x5Mh/hYuYs/9M+ZpTt+y dzmAcdR0TW6M8ZSl9kIxqsiIb2XviOsfRAKZ0m4PUAPVRKo57aJwSMFAeqbTCYuebDt+ vqBaY1hhXRht72CduomgJO2Y+YVySKpUGtV5QiCvB3aWkDkpsXXS8tppM2Pbvb2Y2Bvc bY78ZN0FFWFDhSgBe4HBZQ0GgvCq1iD9NIwRHadADPVZSM1hc4hllgBOyoJCAYm/jZnF SGgRzFTyUhDadttMtzfh5kp7c5p2nCIomEAOadn/LgKXCB1+4CxpX9NO2DwiPHzA6xuz gA== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050096.ppops.net-00190b01. with ESMTP id 2chax2yd0x-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 24 Aug 2017 21:11:42 +0100 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7OKAhee016086; Thu, 24 Aug 2017 16:11:41 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint1.akamai.com with ESMTP id 2cegnunejf-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Thu, 24 Aug 2017 16:11:41 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 24 Aug 2017 16:11:40 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Thu, 24 Aug 2017 16:11:40 -0400 From: "Salz, Rich" To: Yoav Nir , "cpu@letsencrypt.org" CC: IETF ACME Thread-Topic: [Acme] Minutes from IEtf 99 Thread-Index: AdMCE7AQtGH18UnpSrir5nm8k/ol8ga+dXJIAAkviID//8XcAA== Date: Thu, 24 Aug 2017 20:11:40 +0000 Message-ID: References: <59721cd4.4eec1c0a.fce35.8ce0@mx.google.com> <2BD0DD60-A7CB-46A8-A241-418E11234C1A@gmail.com> In-Reply-To: <2BD0DD60-A7CB-46A8-A241-418E11234C1A@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.37.150] Content-Type: multipart/alternative; boundary="_000_A37AB6C40D7341A3A9CA49B5861A9851akamaicom_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708240310 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708240310 Archived-At: Subject: Re: [Acme] Minutes from IEtf 99 X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 20:11:48 -0000 --_000_A37AB6C40D7341A3A9CA49B5861A9851akamaicom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvbWVldGluZy85OS9tYXRlcmlhbHMvbWlu dXRlcy05OS1hY21lDQoNCg0Kw5ggIEtpbmQgb2YgdW5kZXJ3aGVsbWluZywgSSBrbm93Lg0KDQoN CsOYICBSaWNoOiBBcmUgd2UgcGxhbm5pbmcgb24gZmxlc2hpbmcgdGhpcyBvdXQ/DQoNClJpY2hh cmQgQmFybmVzIGhhZCBwcm9taXNlZCB0by4gIEkgc2hvdWxkIHRha2UgYmFjayB0aGUgc3Bpbm5l ciBJIGdhdmUgaGltLg0K --_000_A37AB6C40D7341A3A9CA49B5861A9851akamaicom_ Content-Type: text/html; charset="utf-8" Content-ID: <297208D949554D45930A7A2E511C23DD@akamai.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iVGl0bGUiIGNvbnRlbnQ9IiI+DQo8bWV0YSBuYW1lPSJLZXl3b3JkcyIgY29udGVu dD0iIj4NCjxtZXRhIG5hbWU9IkdlbmVyYXRvciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUg KGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxlPjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCglwYW5vc2UtMToyIDcg MyA5IDIgMiA1IDIgNCA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0K CXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0O30NCi8qIFN0 eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9y bWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTox Mi4wcHQ7DQoJZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7fQ0KYTpsaW5rLCBzcGFuLk1z b0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xs b3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdy YXBoLCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFy Z2luLXRvcDowaW47DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCglt YXJnaW4tbGVmdDouNWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIu MHB0Ow0KCWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCnNwYW4uRW1haWxTdHlsZTE3 DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OkNhbGlicmk7 DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLm1zb0lucw0KCXttc28tc3R5bGUtdHlwZTpleHBv cnQtb25seTsNCgltc28tc3R5bGUtbmFtZToiIjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5l Ow0KCWNvbG9yOnRlYWw7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MzAwNjIzODAzOw0KCW1zby1saXN0LXR5cGU6aHlicmlk Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTcyNjgxMjg2MCA2NzY5ODY5OSA2NzY5ODY5MSA2 NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5 ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+DmDsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1m b250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGlt ZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsN Cglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs NA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0 IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVy IE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZl bDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+C pzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpv bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQotLT48 L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xvcj0id2hpdGUiIGxhbmc9IkVOLVVTIiBsaW5r PSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9InRleHQtaW5kZW50Oi0uMjVpbjttc28tbGlz dDpsMCBsZXZlbDEgbGZvMSI+PCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OldpbmdkaW5ncyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+w5g8c3BhbiBz dHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOw0KPC9z cGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvbWVldGluZy85OS9tYXRlcmlhbHMvbWludXRlcy05OS1hY21lIj5odHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL21lZXRpbmcvOTkvbWF0ZXJpYWxzL21pbnV0ZXMtOTktYWNtZTwv YT4NCjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgi IHN0eWxlPSJ0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lm ICFzdXBwb3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFu IHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7 VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2Vu ZGlmXT5LaW5kIG9mIHVuZGVyd2hlbG1pbmcsIEkga25vdy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJ0ZXh0LWluZGVu dDotLjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBwb3J0TGlzdHNdPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3MiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsOYPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5SaWNoOiBBcmUgd2Ug cGxhbm5pbmcgb24gZmxlc2hpbmcgdGhpcyBvdXQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlJpY2hhcmQgQmFybmVzIGhhZCBwcm9taXNlZCB0by4mbmJzcDsgSSBzaG91 bGQgdGFrZSBiYWNrIHRoZSBzcGlubmVyIEkgZ2F2ZSBoaW0uPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_A37AB6C40D7341A3A9CA49B5861A9851akamaicom_-- From nobody Thu Aug 24 14:08:22 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0355A132026 for ; Thu, 24 Aug 2017 14:08:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Q-41MB91W-K for ; Thu, 24 Aug 2017 14:08:18 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [67.231.149.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DF861321EC for ; Thu, 24 Aug 2017 14:08:18 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7OL71DT026471 for ; Thu, 24 Aug 2017 22:08:16 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=nfUodoTPAFqYLbPSELRywHpvs0t3PcPKWtsLJbeRooU=; b=LdK15J2N/fMm+sCtaaIibawJvP+Bq5Rn7nEZ+yLEzUqey/4qejZhuSF1VFwy0NwTpCwd 9MaM/y6/j4RZcrbS1qfcu2ss5mg0MoQ6rAggOGvq4QsNfdLOl6foCXS5Ssag3c4Pvz4Z PdIr5QWEtlfmfv6muuN9LmQFFn7K6JXn8JfJ/0sTSPQI8O5DwXUF8C25PC+dbGHDequJ 0trrpOfIOmwMxNrZc03EiVGjrzUUEFhUj2ldPJeTYorWg1O3ltmHL8xB0lp2Pu8XaK+a Q0AM9FuPQ+d3D59SqPVXhiF8jB9FTr/LNnOW+frFTlwWVP6ajmJOm4lnEmxWnLJ9tPYh vw== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by mx0a-00190b01.pphosted.com with ESMTP id 2ceck5f8qv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 24 Aug 2017 22:08:16 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7OL5iQn022526 for ; Thu, 24 Aug 2017 17:08:15 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint2.akamai.com with ESMTP id 2cegnunsaw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Thu, 24 Aug 2017 17:08:15 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb4.msg.corp.akamai.com (172.27.123.104) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Thu, 24 Aug 2017 17:08:14 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Thu, 24 Aug 2017 17:08:14 -0400 From: "Salz, Rich" To: "acme@ietf.org" Thread-Topic: ACME notes from IETF99 Thread-Index: AQHTHR0ZMh0j47RDS0ml6tdivM4ZWQ== Date: Thu, 24 Aug 2017 21:08:13 +0000 Message-ID: <24E3ACCF-5F4D-4C13-8AB4-486DA66C3B2C@akamai.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.37.150] Content-Type: text/plain; charset="utf-8" Content-ID: <89C6B766BE6D0A45A73DDEC20814CE3A@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-24_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708240325 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-24_08:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708240326 Archived-At: Subject: [Acme] ACME notes from IETF99 X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Aug 2017 21:08:21 -0000 QW4gYW5vbnltb3VzIGNvcnJlc3BvbmRlbnQgc2VuZHMgdGhlIGZvbGxvd2luZy4gIEkgd2lsbCB0 cnkgdG8gdXBsb2FkIHRoZW0gYnV0IGl0IG1pZ2h0IGJlIHRvbyBsYXRl4oCmDQoNCiAgICANCiAg ICAxLiBkcmFmdC1pZXRmLWFjbWUtYWNtZQ0KICAgIA0KICAgIFRoZSBkcmFmdCBwYXNzZWQgYSBz ZWNvbmQgV0dMQyBhbmQgaGFzIGdvbmUgZm9yIElFU0cgcmV2aWV3LiBUaGVyZSBhcmUgc29tZSBt aW5vciBlZGl0b3JpYWwgaXNzdWVzLiBObyBmdXJ0aGVyIHdvcmsgaXMgZXhwZWN0ZWQuDQogICAg DQogICAgMi4gZHJhZnQtaWV0Zi1hY21lLWNhYQ0KICAgIA0KICAgIFRoZXJlIHdhcyBubyBwcmVz ZW50ZXIgb3Igc2xpZGVzLiBUaGUgQ0FBIGRyYWZ0IHNheXMgd2hhdCBhdXRoZW50aWNhdGlvbiBt ZWNoYW5pc21zIGFyZSBhdmFpbGFibGUuIEl0IGNvdWxkIGFsc28gYmUgdXNlZCBmb3Igbm9uLWFj bWUgbWVjaGFuaXNtcyAoZWcgYnJvd3NlciBDQXMpLiBUaGF0IHdvdWxkIG1lYW4gbWFpbnRhaW5p bmcgYSByZWdpc3RyeSBvZiB0b2tlbnMgZm9yIGF1dGhlbnRpY2F0aW9uIG1lY2hhbmlzbXMgYW5k IGNvLW9wZXJhdGlvbiB3aXRoIHRoZSBDQS9CIEZvcnVtLiBJdCBpcyBsb29raW5nIGF0IGltcHJv dmluZyBpdHMgYXV0aGVudGljYXRpb24gc3R1ZmYgYW5kIHdvdWxkIHByb2JhYmx5IGJlIHJlY2Vw dGl2ZS4gQ0EvQiBGb3J1bSBzZWVtcyB0byBsYWNrIGZvY3VzIHRob3VnaDogbWlnaHQgbmVlZCB0 aGVtIHRvIGNvbW1pdCB0byBhIGRlYWRsaW5lLiBUaGUgQ0EvQiBGb3J1bSBoYXMgY29uY2VybnMg dGhhdCBuZXcgYmFzZWxpbmUgcmVxdWlyZW1lbnRzIHdpbGwgYmUgYmFja3dhcmRzIGNvbXBhdGli bGUuDQogICAgDQogICAgVGhlcmUgd2FzIGEgdW5hbmltb3VzIGh1bSBmb3IgYSBzb2x1dGlvbiB0 aGF0IGRvZXMgYWNtZSBhbmQgbm9uLWFjbWUgYXV0aCBtZXRob2RzLg0KICAgIA0KICAgIDMuIGRy YWZ0LWlldGYtYWNtZS1zdGFyDQogICAgCQ0KICAgIFRoZSBkcmFmdCBkaXNjdXNzZXMgYXV0by1y ZW5ld2FsIG1lY2hhbmlzbXMuIEl04oCZcyBub3QgY2xlYXIgd2hhdCBzaG91bGQgYmUgZG9uZSB3 aGVuIHRoZSBjZXJ0aWZpY2F0ZSBsaWZlIGFuZCB0aGUgRXhwaXJlOiBoZWFkZXIgZGlzYWdyZWUu IFBlcmhhcHMgYW4gYWJzb2x1dGUgZGF0ZSBjb3VsZCBiZSB1c2VkIGZvciBraWxsaW5nIHRoZSBj ZXJ0aWZpY2F0ZSBldmVuIGlmIGFuIGFjbWUgY2xpZW50IGlzIHJlbmV3aW5nL3JlZnJlc2hpbmcg bG9va3Vwcy4gQ2VydGlmaWNhdGUgcmV2b2NhdGlvbiBpc3N1ZXMgYXJlIG5vdCB5ZXQgZnVsbHkg d29ya2VkIG91dC4gSXQgd2FzIHN1Z2dlc3RlZCBhY21lIGNlcnRpZmljYXRlcyBjb3VsZCB1c2Ug dGhyZWUgdmFsdWVzOiBpcyBhdmFpbGFibGUgZnJvbS9pcyBhdmFpbGFibGUgdW50aWwvZHJvcCBk ZWFkIGRhdGUgZm9yIGF1dG9tYXRlZCByZW5ld2FsLg0KICAgIA0KICAgIEEgbmV3IHZlcnNpb24g b2YgdGhlIGRyYWZ0IHNob3VsZCBiZSBkb25lIGZvciBJRVRGMTAwIGFuZCB3b3VsZCBwcm9iYWJs eSBnbyBmb3IgV0dMQy4NCiAgICANCiAgICBkcmFmdC1pZXRmLWFjbWUtc3Rhci1yZXF1ZXN0DQog ICAgDQogICAgVGhpcyByZWxhdGVkIGRyYWZ0IHdhcyBub3QgZGlzY3Vzc2VkLiBJdCB3aWxsIHBy b2JhYmx5IGdldCBhZG9wdGVkIGFzIGEgV0cgZG9jdW1lbnQgYXQgYSBmdXR1cmUgbWVldGluZy4N CiAgICANCiAgICA0LiBkcmFmdC1pZXRmLWFjbWUtdGVsZXBob25lDQogICAgCQ0KICAgIEpvbiBQ ZXRlcnNvbuKAmXMgc2xpZGVzIGFyZSBoZXJlOg0KICAgIA0KICAgIGh0dHBzOi8vd3d3LmlldGYu b3JnL3Byb2NlZWRpbmdzLzk5L3NsaWRlcy9zbGlkZXMtOTktYWNtZS1zdGlyLXRucy1mb3ItYWNt ZS0wMC5wZGYNCiAgICANCiAgICBFbmRwb2ludHMgY291bGQgaGF2ZSBhdXRoZW50aWNhdGlvbiB0 b2tlbnMsIHRob3VnaCBpdOKAmXMgbW9yZSBsaWtlbHkgdG8gYmUgdGhlIGludGVybWVkaWFyeSAo U0lQIHByb3h5LCBTQkMsIGV0YykgdGhhdCBob2xkcyB0aGVzZS4gSm9uIHdhcy9pcyB0cnlpbmcg dG8gYmUgbmV1dHJhbCBvbiBob3cgdGhlc2UgdG9rZW5zIHdvdWxkIGJlIHN0b3JlZCBhbmQgYWNj ZXNzZWQuIEN1cnJlbnQgdGhpbmtpbmcgaW4gdGhlIHRlbGNvIHdvcmxkIGlzIHRoZXNlIHdvdWxk IGJlIGluIGEgZGF0YWJhc2Ugb3duZWQsIG9wZXJhdGVkIGFuZCBjb250cm9sbGVkIGJ5IHRoZSB0 ZWxjbyByZXNwb25zaWJsZSBmb3IgdGhlIG51bWJlciAoYmxvY2spLiBBbiBFTlVNIGxpa2Ugc29s dXRpb24gd291bGQgYmUgYW4gb2J2aW91cyBhcHByb2FjaCBzaW5jZSBib3RoIEUuMTY0IG51bWJl cmluZyBhbmQgZG9tYWluIG5hbWVzIHVzZSBoaWVyYXJjaGljYWwgbmFtZSBzcGFjZXMuIEhvd2V2 ZXIgdGVsY29zIHNlZW0gdG8gYmUgaG9zdGlsZSB0byBhIEROUy1iYXNlZCBhcHByb2FjaC4gDQog ICAgDQogICAgNS4gZHJhZnQtaWV0Zi1hY21lLXNlcnZpY2UtcHJvdmlkZXINCiAgICANCiAgICBN YXJ5IEJhcm5lc+KAmXMgc2xpZGVzIGFyZSBoZXJlOiANCiAgICBodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL21lZXRpbmcvOTkvbWF0ZXJpYWxzL3NsaWRlcy05OS1hY21lLWFjbWUtaWRlbnRp ZmllcnMtYW5kLWNoYWxsZW5nZXMtZm9yLXZvaXAtc2VydmljZS1wcm92aWRlcnMNCiAgICANCiAg ICBUaGUgZHJhZnTigJlzIGJlZW4gdXBkYXRlZCB0byBhY2NvdW50IGZvciB0aGUgc2VydmljZSBw cm92aWRlciBjb2RlIHRva2VuIHVzZWQgYnkgU0hBS0VOIChzaWduYXR1cmUtYmFzZWQgaGFuZGxp bmcgb2YgYXNzZXJ0ZWQgaW5mb3JtYXRpb24gdXNpbmcgdG9rZW4pLCB0aGUgc3BlY2lmaWNhdGlv biBhZG9wdGVkIGJ5IHR3byBVUyB0ZWxjbyBib2RpZXMsIEFUSVMgYW5kIHRoZSBTSVAgRm9ydW0u IFJpY2hhcmQgQmFybmVzIHN1Z2dlc3RlZCB0aGlzIGNvdWxkIGJlY29tZSBhIGdlbmVyaWMgaWRl bnRpZmljYXRpb24gbWVjaGFuaXNtLCBub3QganVzdCBmb3IgcGhvbmUgbnVtYmVyIHNhbmQgU0lQ IGFkZHJlc3Nlcy4NCiAgICANCiAgICA2LiBkcmFmdC1pZXRmLWFjbWUtZW1haWwtc21pbWUgYW5k IGRyYWZ0LWlldGYtYWNtZS1lbWFpbC10bHMNCiAgICAgDQogICAgQWxleGV5IE1lbG5pa2924oCZ cyBzbGlkZXM6DQogICAgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9tZWV0aW5nLzk5L21h dGVyaWFscy9zbGlkZXMtOTktYWNtZS1hY21lLWZvci1lbWFpbC1zZXJ2aWNlcw0KICAgIA0KICAg IEFsZXhleSBzYWlkIHRoZXJl4oCZcyBhIGRlbWFuZCBmb3IgYXV0aGVudGljYXRpbmcgSU1BUChT KSBzZXJ2ZXJzLiBUaGUgV0cgZGlkbuKAmXQgaGF2ZSBhIGNsZWFyIGNvbnNlbnN1cyBmb3IgYW55 IG9mIHRoZSB0aHJlZSBvcHRpb25zIGhlIHByb3Bvc2VkLiBUaGVyZSB3YXMgc29tZSBvYmplY3Rp b24gdG8gdXNpbmcgYSBTZXJ2aWNlIE5hbWUgSW5kaWNhdGlvbiBpbiBUTFMuIEhlIGFncmVlZCB0 byBkcm9wIHRoYXQgYW5kIGNvbnRpbnVlIHdpdGggdGhlIG9wdGlvbnMgb2YgdXNpbmcgRE5TIFNS ViByZWNvcmRzIChvciBzaW1pbGFyKSB0byBzcGVjaWZ5IHRoZSBwcm90b2NvbCBhbmQgcG9ydCBu dW1iZXIgb3IgYWRkaW5nIGV4dGVuc2lvbnMgdG8gU01UUCBhbmQgSU1BUC4NCiAgICANCiAgICBU aGUgV0cgbm90ZWQgQWxleGV54oCZcyBvcHRpbWlzbSBmb3IgUy9NSU1FLiBIZSBjbGFpbWVkIGl0 IGlzIG1vcmUgd2lkZWx5IGRlcGxveWVkIHRoYW4gbW9zdCBwZW9wbGUgcmVhbGlzZS4gU29tZSBP dXRsb29rIHVzZXJzIGFyZSBmb3JjZWQgdG8gdXNlIFMvTUlNRS4NCiAgICANCiAgICA3LiBSZWNo YXJ0ZXIgZGlzY3Vzc2lvbg0KICAgIA0KICAgIFRoaXMgd2FzIG92ZXIgaW4gYSBmZXcgc2Vjb25k cy4gQUQgS2F0aGxlZW4gTW9yaWFydHkgc2FpZCB0aGUgV0cgc2hvdWxkIGp1c3QgdXBkYXRlIGl0 cyBtaWxlc3RvbmVzIGFuZCBjaGFydGVyIGFuZCB0aGVuIGluZm9ybSB0aGUgSUVTRy4gVGhlIFdH IGRpZCBub3Qgc2VlbSB0byB3YW50IG9yIG5lZWQgYSBsb25nIGRlYmF0ZSBvdmVyIHdoYXQgdGhl IHJldmlzZWQgbWlsZXN0b25lcyBhbmQgY2hhcnRlciBzaG91bGQgYmUuIFRoZSBXRyBjby1jaGFp cnMgd2lsbCBwcm9iYWJseSBiZSByZXNwb25zaWJsZSBmb3IgdXBkYXRpbmcgdGhlc2UgYW5kIGdl dHRpbmcgV0cgY29uc2Vuc3VzLg0KICAgIA0KICAgIDguIEFPQg0KICAgIA0KICAgIFNvbWVvbmUg YXNrZWQgaWYgQ0FzIHdvdWxkIGlzc3VlIEFDTUUtYmFzZWQgY2VydGlmaWNhdGVzIGZvciBhY21l LiBSaWNoYXJkIEJhcm5lcyBzYWlkIERpZ2ljZXJ0IHdhcyBzdGlsbCB0cnlpbmcgdG8gd29yayBv dXQgd2hhdCB0byBkby4gVGhleSB3ZXJlIGludGVyZXN0ZWQgaW4gcHJpbmNpcGxlLg0KICAgIA0K ICAgIFlvYXYgTmlyIGhhcyByZXBsYWNlZCBUZWQgSGFyZGllIGFzIGNvLWNoYWlyIG5vdyB0aGF0 IFRlZCBoYXMgYmVlbiBhcHBvaW50ZWQgdG8gdGhlIElBQi4NCiAgICANCiAgICANCg0K From nobody Wed Aug 30 01:32:17 2017 Return-Path: X-Original-To: acme@ietf.org Delivered-To: acme@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D0CA81323B5; Wed, 30 Aug 2017 01:32:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: acme@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.59.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <150408192980.21632.5327506427066948204@ietfa.amsl.com> Date: Wed, 30 Aug 2017 01:32:09 -0700 Archived-At: Subject: [Acme] I-D Action: draft-ietf-acme-caa-03.txt X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Aug 2017 08:32:10 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Automated Certificate Management Environment WG of the IETF. Title : CAA Record Extensions for Account URI and ACME Method Binding Author : Hugo Landau Filename : draft-ietf-acme-caa-03.txt Pages : 9 Date : 2017-08-30 Abstract: The CAA DNS record allows a domain to communicate issuance policy to CAs, but only allows a domain to define policy with CA-level granularity. However, the CAA specification also provides facilities for extension to admit more granular, CA-specific policy. This specification defines two such parameters, one allowing specific accounts of a CA to be identified by URI and one allowing specific methods of domain control validation as defined by the ACME protocol to be required. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-acme-caa/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-acme-caa-03 https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-acme-caa-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Aug 30 01:37:46 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FB591323B5 for ; Wed, 30 Aug 2017 01:37:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=devever.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UNeXkBZiSe2q for ; Wed, 30 Aug 2017 01:37:43 -0700 (PDT) Received: from umbriel.devever.net (umbriel.devever.net [149.202.51.241]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A7B4132386 for ; Wed, 30 Aug 2017 01:37:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with ESMTP id 352CB1D76D for ; Wed, 30 Aug 2017 10:37:41 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=devever.net; h= user-agent:in-reply-to:content-disposition:content-type :content-type:mime-version:references:message-id:subject:subject :from:from:date:date:received:received; s=mimas; t=1504082261; x=1522271622; bh=djE7btDX7zl//ixG/HnmBgDXYBRKmVDXp4MxpHiyBiw=; b= gCxefCuVbQ6WnDO9bJE2v+l7eSgXgr6ZPo2q5o3Ucx5cCcVd5PmorBFK6Eye2ryD cGQHkgE/jmPl3CVTmYALDsoKGq0FNuJzS4cOZdLIbr2SujKOd1oFUhXL6j8K5ikp FXwNBiSrsFN5d9nNMzhHQTV0+JZMs3/iL+mlPrH1o7kmNdzQJ2Z023tiL+mMwcG8 5ReMUC2rdayrbEtMK8OJMhuFvpfkf4IF6/J/WOw4xWs4dSfODuFctPZXvIONt0p5 s3K5Kv88ZuBdfbbJh+Q7xAs+ZmSb+/z1oqzkv/2+wOKo+PQNnL3f1gmKChQcAbj8 ZveHC8oQcg4WrhiDMk0O+Q== Received: from umbriel.devever.net ([127.0.0.1]) by localhost (umbriel.devever.net [127.0.0.1]) (amavisd-new, port 10026) with LMTP id 3EZWItVWbpw3 for ; Wed, 30 Aug 2017 10:37:41 +0200 (CEST) Received: from andover.lhh.devever.net (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with SMTP id E7D4E1D76A for ; Wed, 30 Aug 2017 10:37:40 +0200 (CEST) Date: Wed, 30 Aug 2017 09:37:40 +0100 From: Hugo Landau To: acme@ietf.org Message-ID: <20170830083740.GA5095@andover.lhh.devever.net> References: <150408192980.21632.5327506427066948204@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <150408192980.21632.5327506427066948204@ietfa.amsl.com> User-Agent: Mutt/1.8.1 (2017-04-11) Archived-At: Subject: Re: [Acme] I-D Action: draft-ietf-acme-caa-03.txt X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Aug 2017 08:37:45 -0000 > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Automated Certificate Management Environment WG of the IETF. > > Title : CAA Record Extensions for Account URI and ACME Method Binding > Author : Hugo Landau > Filename : draft-ietf-acme-caa-03.txt > Pages : 9 > Date : 2017-08-30 > > Abstract: > The CAA DNS record allows a domain to communicate issuance policy to > CAs, but only allows a domain to define policy with CA-level > granularity. However, the CAA specification also provides facilities > for extension to admit more granular, CA-specific policy. This > specification defines two such parameters, one allowing specific > accounts of a CA to be identified by URI and one allowing specific > methods of domain control validation as defined by the ACME protocol > to be required. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-acme-caa/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-acme-caa-03 > https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa-03 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-acme-caa-03 > > > Please note that it may take a couple of minutes from the time of submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ No surprises here, just rolling up the validation-methods change. From nobody Wed Aug 30 05:58:38 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E6ED133209 for ; Wed, 30 Aug 2017 05:58:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.721 X-Spam-Level: X-Spam-Status: No, score=-2.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KpyyjJjwiFdL for ; Wed, 30 Aug 2017 05:58:33 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [67.231.149.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74AEE133203 for ; Wed, 30 Aug 2017 05:58:33 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7UCuwCM006523 for ; Wed, 30 Aug 2017 13:58:32 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=qbqsMV7dIaHCLT0ejaKL8c4cWb5ZHylptGunznBAIwk=; b=XtUX3FGliG2zAbJaFdK4QMvoHj05JvmckYvqpcofYJvlgyZicTgZsXK9ZW7vnx1KNIHP ZX3P8FugMwyw3R7rfVRDOVqD+6prCmrArdG2D8UCXCTtySmtHtKWt2Lp/mLzpcPBxnpm LZeeUz4K6ZSEkRbXvMwomiTfsj8FH5yASy7JtuXiG84tXH/SJViMCooTn6fnPQFdia7L zee/PY0kEiGVCelQR8vHEuI8Xh8/Ahoq71u8mP7ETulzgyzOGSegf3xrQrImu+MfY1uS Wu1oKHDyV6HDkd5SVl0n2dvg+VLz7Z4/HCWqVDf1+I05zFhoVnMvoNilGFZc2/SG47pE sg== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by mx0a-00190b01.pphosted.com with ESMTP id 2ck0846j0d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 30 Aug 2017 13:58:31 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.17/8.16.0.17) with SMTP id v7UCttj3004471 for ; Wed, 30 Aug 2017 08:58:30 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.33]) by prod-mail-ppoint2.akamai.com with ESMTP id 2ck4auscnw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Wed, 30 Aug 2017 08:58:30 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb1.msg.corp.akamai.com (172.27.123.101) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Wed, 30 Aug 2017 08:58:30 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1263.000; Wed, 30 Aug 2017 08:58:30 -0400 From: "Salz, Rich" To: "acme@ietf.org" Thread-Topic: [Acme] I-D Action: draft-ietf-acme-caa-03.txt Thread-Index: AQHTIWqLxy6rkfTOUUWyZItpSuoIEaKc1rMAgAAF1IA= Date: Wed, 30 Aug 2017 12:58:29 +0000 Message-ID: <52069FA8-D155-404E-B6C2-A8D5B2EAB386@akamai.com> References: <150408192980.21632.5327506427066948204@ietfa.amsl.com> <20170830083740.GA5095@andover.lhh.devever.net> In-Reply-To: <20170830083740.GA5095@andover.lhh.devever.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.1b.0.161010 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.40.59] Content-Type: text/plain; charset="utf-8" Content-ID: <7F2949768D85DA49A5BDFFECFA5FEC5F@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-30_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708300195 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-30_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708300195 Archived-At: Subject: [Acme] FW: I-D Action: draft-ietf-acme-caa-03.txt X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Aug 2017 12:58:35 -0000 SWYgeW91IHJhaXNlZCBjb25jZXJucyBiZWZvcmUsIHBsZWFzZSBzZWUgaWYgdGhpcyBsYXRlc3Qg ZHJhZnQgcmVzb2x2ZXMgdGhlbS4NCg0KSWYgdGhlcmUgYXJlIG5vIG9iamVjdGlvbnMgYnkgbmV4 dCBXZWRzLCAgU2VwdCA2LCB3ZSB3aWxsIG1vdmUgdGhpcyBmb3J3YXJkIHRvIHRoZSBJRVNHLg0K DQpPbiA4LzMwLzE3LCA0OjM3IEFNLCAiSHVnbyBMYW5kYXUiIDxobGFuZGF1QGRldmV2ZXIubmV0 PiB3cm90ZToNCg0KICAgID4gQSBOZXcgSW50ZXJuZXQtRHJhZnQgaXMgYXZhaWxhYmxlIGZyb20g dGhlIG9uLWxpbmUgSW50ZXJuZXQtRHJhZnRzIGRpcmVjdG9yaWVzLg0KICAgID4gVGhpcyBkcmFm dCBpcyBhIHdvcmsgaXRlbSBvZiB0aGUgQXV0b21hdGVkIENlcnRpZmljYXRlIE1hbmFnZW1lbnQg RW52aXJvbm1lbnQgV0cgb2YgdGhlIElFVEYuDQogICAgPiANCiAgICA+ICAgICAgICAgVGl0bGUg ICAgICAgICAgIDogQ0FBIFJlY29yZCBFeHRlbnNpb25zIGZvciBBY2NvdW50IFVSSSBhbmQgQUNN RSBNZXRob2QgQmluZGluZw0KICAgID4gICAgICAgICBBdXRob3IgICAgICAgICAgOiBIdWdvIExh bmRhdQ0KICAgID4gCUZpbGVuYW1lICAgICAgICA6IGRyYWZ0LWlldGYtYWNtZS1jYWEtMDMudHh0 DQogICAgPiAJUGFnZXMgICAgICAgICAgIDogOQ0KICAgID4gCURhdGUgICAgICAgICAgICA6IDIw MTctMDgtMzANCiAgICA+IA0KICAgID4gQWJzdHJhY3Q6DQogICAgPiAgICBUaGUgQ0FBIEROUyBy ZWNvcmQgYWxsb3dzIGEgZG9tYWluIHRvIGNvbW11bmljYXRlIGlzc3VhbmNlIHBvbGljeSB0bw0K ICAgID4gICAgQ0FzLCBidXQgb25seSBhbGxvd3MgYSBkb21haW4gdG8gZGVmaW5lIHBvbGljeSB3 aXRoIENBLWxldmVsDQogICAgPiAgICBncmFudWxhcml0eS4gIEhvd2V2ZXIsIHRoZSBDQUEgc3Bl Y2lmaWNhdGlvbiBhbHNvIHByb3ZpZGVzIGZhY2lsaXRpZXMNCiAgICA+ICAgIGZvciBleHRlbnNp b24gdG8gYWRtaXQgbW9yZSBncmFudWxhciwgQ0Etc3BlY2lmaWMgcG9saWN5LiAgVGhpcw0KICAg ID4gICAgc3BlY2lmaWNhdGlvbiBkZWZpbmVzIHR3byBzdWNoIHBhcmFtZXRlcnMsIG9uZSBhbGxv d2luZyBzcGVjaWZpYw0KICAgID4gICAgYWNjb3VudHMgb2YgYSBDQSB0byBiZSBpZGVudGlmaWVk IGJ5IFVSSSBhbmQgb25lIGFsbG93aW5nIHNwZWNpZmljDQogICAgPiAgICBtZXRob2RzIG9mIGRv bWFpbiBjb250cm9sIHZhbGlkYXRpb24gYXMgZGVmaW5lZCBieSB0aGUgQUNNRSBwcm90b2NvbA0K ICAgID4gICAgdG8gYmUgcmVxdWlyZWQuDQogICAgPiANCiAgICA+IA0KICAgID4gVGhlIElFVEYg ZGF0YXRyYWNrZXIgc3RhdHVzIHBhZ2UgZm9yIHRoaXMgZHJhZnQgaXM6DQogICAgPiBodHRwczov L2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1pZXRmLWFjbWUtY2FhLw0KICAgID4gDQog ICAgPiBUaGVyZSBhcmUgYWxzbyBodG1saXplZCB2ZXJzaW9ucyBhdmFpbGFibGUgYXQ6DQogICAg PiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1hY21lLWNhYS0wMw0KICAg ID4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1pZXRmLWFjbWUt Y2FhLTAzDQogICAgPiANCiAgICA+IEEgZGlmZiBmcm9tIHRoZSBwcmV2aW91cyB2ZXJzaW9uIGlz IGF2YWlsYWJsZSBhdDoNCiAgICA+IGh0dHBzOi8vd3d3LmlldGYub3JnL3JmY2RpZmY/dXJsMj1k cmFmdC1pZXRmLWFjbWUtY2FhLTAzDQogICAgPiANCiAgICA+IA0KICAgID4gUGxlYXNlIG5vdGUg dGhhdCBpdCBtYXkgdGFrZSBhIGNvdXBsZSBvZiBtaW51dGVzIGZyb20gdGhlIHRpbWUgb2Ygc3Vi bWlzc2lvbg0KICAgID4gdW50aWwgdGhlIGh0bWxpemVkIHZlcnNpb24gYW5kIGRpZmYgYXJlIGF2 YWlsYWJsZSBhdCB0b29scy5pZXRmLm9yZy4NCiAgICA+IA0KICAgID4gSW50ZXJuZXQtRHJhZnRz IGFyZSBhbHNvIGF2YWlsYWJsZSBieSBhbm9ueW1vdXMgRlRQIGF0Og0KICAgID4gZnRwOi8vZnRw LmlldGYub3JnL2ludGVybmV0LWRyYWZ0cy8NCiAgICBObyBzdXJwcmlzZXMgaGVyZSwganVzdCBy b2xsaW5nIHVwIHRoZSB2YWxpZGF0aW9uLW1ldGhvZHMgY2hhbmdlLg0KICAgIA0KICAgIF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgQWNtZSBtYWls aW5nIGxpc3QNCiAgICBBY21lQGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9hY21lDQogICAgDQoNCg== From nobody Thu Aug 31 14:46:49 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDF6C1321AA for ; Thu, 31 Aug 2017 14:46:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mH8mPOxLVOk5 for ; Thu, 31 Aug 2017 14:46:46 -0700 (PDT) Received: from mail-ua0-x236.google.com (mail-ua0-x236.google.com [IPv6:2607:f8b0:400c:c08::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 327141252BA for ; Thu, 31 Aug 2017 14:46:46 -0700 (PDT) Received: by mail-ua0-x236.google.com with SMTP id g16so1191509uah.3 for ; Thu, 31 Aug 2017 14:46:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=SCKMs5D2t2lU15nJ1z1Q+X8got90Jqpz7Gfk5xcA3DQ=; b=ZsTc6561EYtyREPYPz15KBGn7HGl8tzWGhH4S3aLflN/OpU28xqStKdIWDfJ6oHsDB +/TNNYho8oRhwOrlMGsHkto7BCozXATpi3ViHl/GeMb776YpolSHNmqmMeHzEDLKG1nz M17uyUJ8N+HLFMyA09qnHecMoNpPa9yKDhU50tWxqqGtPQKW9o8R9x/dcaBCyE2kqpuW VurNlrKqCNUmpl8Ea9wJgib8OhZNwtn/kkYQqtmym2pXh3GWaUJY8Wk+nBwqaTZs1Ol5 VwtG64h6rIe93zkkgC+Chx6+nLia3T74oECpn81C7Ytt5MK/weYoflCODsL9GW4NuBMY 7hkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=SCKMs5D2t2lU15nJ1z1Q+X8got90Jqpz7Gfk5xcA3DQ=; b=jTKrznEaz8Zx9tpo2Lp466GFomBTzV41G0B8+YKV7Oy9TF4VscI7ktNJCQeHBka1Kw NF3WHkTFUDrF2uaWChBc8wted+R6SnFCr7W+QU+P0gRHoTtx9cpiRBxkOt3vGEEb4xGl EIIZuIQELJ7GjceA/aYpMK95RyOxGxx0k1dL6QtG2+YfzFQMFoxSaEswnIIIZFRVHXvW RJtQrEaBJDad1yQg/5HD3yH7GqZ7CONivoQK95iqqGNeRXsZ/+3CiGSC2l+ifRZJO5aq soVvLlcCJwma/BAZjAHUTiteoFNAIlLh0vKFRSF7vM4EYClbiCjpksjWkoaaHZCjbsbh tKRw== X-Gm-Message-State: AHPjjUjFk3vaBCaL8bRYb3Q2H8DQenodUloSI7rSjpcXvjPZCytAoT+A joe4FaofFNggG6+LSB4w92ktw1OMdQ0GC8psCQ== X-Google-Smtp-Source: ADKCNb6etBhNGMwB2KbnaI3nUyf47WhiGIqh4GJn9ANLP71eiPBb7S5Q7A3LRHBbsnhd0Kzpiy9gRiU3QEqlu5vmBkY= X-Received: by 10.176.26.24 with SMTP id a24mr4654162uai.102.1504216004544; Thu, 31 Aug 2017 14:46:44 -0700 (PDT) MIME-Version: 1.0 Received: by 10.31.50.204 with HTTP; Thu, 31 Aug 2017 14:46:43 -0700 (PDT) From: Ben Schwartz Date: Thu, 31 Aug 2017 17:46:43 -0400 Message-ID: To: acme@ietf.org Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="f40304366528a7b50f0558139462" Archived-At: Subject: [Acme] On draft-ietf-acme-ip X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Aug 2017 21:46:48 -0000 --f40304366528a7b50f0558139462 Content-Type: multipart/alternative; boundary="f403043665289e7f48055813948f" --f403043665289e7f48055813948f Content-Type: text/plain; charset="UTF-8" Hi all, This is a very late comment from IETF 99. I just wanted to speak up in support of draft-ietf-acme-ip, as a potential user. My team has developed a product that makes it easy for users to open an account on a VPS provider and start an instance of a server for personal use. Our users are nontechnical, and they don't own a domain name. They can barely handle opening one account; opening another one (with a registrar and/or a certificate authority) would be a nonstarter. Currently, we can't offer users access to their server in a standard web browser, because we can't programmatically acquire a certificate for them. Instead, we generate a self-signed certificate, and pass the fingerprint through a trusted channel to a special-purpose client. draft-ietf-acme-ip would allow our users to access their servers with at least protection from a passive adversary. --Ben --f403043665289e7f48055813948f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

This is a very late comment fro= m IETF 99.

I just wanted to speak up in support of= =C2=A0draft-ietf-acme-ip, as a potential user.=C2=A0 My team has developed = a product that makes it easy for users to open an account on a VPS provider= and start an instance of a server for personal use.=C2=A0 Our users are no= ntechnical, and they don't own a domain name.=C2=A0 They can barely han= dle opening one account; opening another one (with a registrar and/or a cer= tificate authority) would be a nonstarter.

Current= ly, we can't offer users access to their server in a standard web brows= er, because we can't programmatically acquire a certificate for them.= =C2=A0 Instead, we generate a self-signed certificate, and pass the fingerp= rint through a trusted channel to a special-purpose client.

<= /div>
draft-ietf-acme-ip would allow our users to access their servers = with at least protection from a passive adversary.

--Ben
--f403043665289e7f48055813948f-- --f40304366528a7b50f0558139462 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMEWk1v8tAoqKgb7TXMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE3MDcxNjE4MDA1N1oXDTE4MDEx MjE4MDA1N1owIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQDrrvmiOAZVIqT/TMjrb2h2F3pRDbwPjoYSzvDlNRXLUzcCg2CJ l36iW3dmk3Uk0b5/75WIQYoQmadF45yr6fGoxDn9+Qu6hik36Cfrnb8Ch8pnX2jC4gYmE91pm30t /WRb0Bfowu4grOB/zO0vDUZdjFxN/dji7A/mdsk7P5PGcnYxdpnjXSlPTEVxhmheji+DGiCJasrp NNm4883FD4rFnanXYdnCq7Aku1rkA++G+fTQd+9HxlypxSnhExAit0HqOIyCgajEMb+xtkNCHjDH FsOH9ruRqlSKc7FlOLvm2RALFx+U9AqWWx28lyEVhsdeFh6hpLEo+Ae8z8CJYs3zAgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFBe3U8DtRm5koQ3yzeR81BIU+BjrMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQBRIW5hM7R7/1ED1m6w QFXdOIBKubSej9FmVfD+f9Wv/6ak/8Fbk6ByRSzsScPGnkDT2U3MD20bGa+qp5BbEc3gFMi26AIo 7e/G5NlFY6ejl0qKt0xDqbTC+dBYocL/iEYEoAcr0ddFmnIm+tYzXSqSS9dLxPG/dlRo6OTLqtOm 9mExKPl/poRX59vajzNtGnR8gjHIKYCSsG9DdpYMxdQjbyLe71wv/ehtAUO5TcFQshSTtkqkL0y/ UJn76TjASXDDQE0Ndax1+xKdXaNBXFkhh7s/spJxkTrWAYIR+6Vs11eyRKxHo6yMHV+rN71AQm+P dXTVU6D7/eZUZaWxeAc+MYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMEWk1v8tA oqKgb7TXMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCBgqFrTFmV1+WK5DxVFB7oL PK3HzJorNigkjZFF8ZfMYzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xNzA4MzEyMTQ2NDVaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEA5ruU+B/WdqxsyyPpN+T+YAI0sTHyFfLaYCIZQsGU cXoyHVoJzPtQOysZZ55qu9ZEa5DmaLr7Phrd2aIX+SUVmJ9yOrrqRaHzpyerqtUn2He+XeA9vXYu SUVaFNK5Eo0U6EiiUWE0H+PuKzIZgwe8XrcfSsIrqCUagIJEyjJW2IdTYsgYFWAbeSvBt1xHet/o 9uPQ3FCQLGpcWaEcnSyezIErJH4jFjoG0sSkS9siim+byPhF+Bf5gIQI3+CkoV1hLwfcVSs7WNJw 3DQu2PN+3XDUZ8xvdUIPSXEiPji2sRoeJD/atKyLTywWYTzFXeP2G1axx4aMNJSEdCdSgOqB9g== --f40304366528a7b50f0558139462-- From nobody Thu Aug 31 17:25:15 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7772132E8E for ; Thu, 31 Aug 2017 17:25:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QfC6FwTsNqst for ; Thu, 31 Aug 2017 17:25:11 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 283CF132EA7 for ; Thu, 31 Aug 2017 17:25:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 31711BE8E; Fri, 1 Sep 2017 01:25:08 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KHLKn8a6xDPB; Fri, 1 Sep 2017 01:25:04 +0100 (IST) Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E9EFABE80; Fri, 1 Sep 2017 01:25:03 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1504225504; bh=ZtkQM5QgUc78kd7kAqNXzJifMwYOgH8STyeY+grCmgg=; h=Subject:To:References:From:Date:In-Reply-To:From; b=gkpthyopDp2xxRMpkS2jXCnD1ybRJvtxDQfYuOrvKeU4PB+X4p0QUq+Sc7VyLomSn MjCh9KA0nQT+iXC8/JYHHOOYJOK36BwFUS6G84lWkkeIoCs0UZZiMjtdwYEEYv7ZS6 DdTZUy6eFTUr6UuAFGzmVHmre63+XxjTYIqVlI2E= To: Ben Schwartz , acme@ietf.org References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: Date: Fri, 1 Sep 2017 01:25:03 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="hbFHJNpTqKsmahAq7PsaSNk4dIGJtkTDt" Archived-At: Subject: Re: [Acme] On draft-ietf-acme-ip X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Sep 2017 00:25:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hbFHJNpTqKsmahAq7PsaSNk4dIGJtkTDt Content-Type: multipart/mixed; boundary="u21UeFrkohitDmwDNec0duCEdV6C7NNFM"; protected-headers="v1" From: Stephen Farrell To: Ben Schwartz , acme@ietf.org Message-ID: Subject: Re: [Acme] On draft-ietf-acme-ip References: In-Reply-To: --u21UeFrkohitDmwDNec0duCEdV6C7NNFM Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable Hiya, On 31/08/17 22:46, Ben Schwartz wrote: > Hi all, >=20 > This is a very late comment from IETF 99. Here's an even later and less well-informed comment. (Sorry, I didn't notice the traffic on this draft before now;-) I really like the idea that the acme WG aims to figure out a way to enable people at home to use https with their home n/w routers. I'm not at all sure that a DNS-based approach here will cut the mustard, though it's a not-bad plan to define one in any case. I'd love that we chat about this topic involving folks from the acme and homenet WGs, as it seems those are the sets of IETF folks who might be most relevant for the discussion. Lastly, having read the WG mails related to this draft, I do get that a solution that doesn't muck around CAB forum policies is needed, (or else that browser should barf the cert) I'd also argue that it may be easier to work around CAB forum than the realities of DNS. (That said, I do not have a concrete suggestion for how to solve this problem, sorry;-) Cheers, S. >=20 > I just wanted to speak up in support of draft-ietf-acme-ip, as a potent= ial > user. My team has developed a product that makes it easy for users to = open > an account on a VPS provider and start an instance of a server for pers= onal > use. Our users are nontechnical, and they don't own a domain name. Th= ey > can barely handle opening one account; opening another one (with a > registrar and/or a certificate authority) would be a nonstarter. >=20 > Currently, we can't offer users access to their server in a standard we= b > browser, because we can't programmatically acquire a certificate for th= em. > Instead, we generate a self-signed certificate, and pass the fingerprin= t > through a trusted channel to a special-purpose client. >=20 > draft-ietf-acme-ip would allow our users to access their servers with a= t > least protection from a passive adversary. >=20 > --Ben >=20 >=20 >=20 > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme >=20 --u21UeFrkohitDmwDNec0duCEdV6C7NNFM-- --hbFHJNpTqKsmahAq7PsaSNk4dIGJtkTDt Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBCAAGBQJZqKjfAAoJEC88hzaAX42iaTkH/AjPa5sjQgkW5Fd9o9IWXIRl KDq1cK1Eaur4T0kY95WHlAb2jwPgvgYQWFMDk7RxTKJDJ07me+H+Q5zkMoFEc6zX IUkfYi53c3B7+r+5RDTepOsJ30W8dlKsaFaqkLpfh+BI2zEYW8XdN+xJQHulzBYG /uZmgm5tFSum7/eHG2YXoT5bjYWTPcaBT6gzeU6f6EPTABpBi5+Q8AKeXOxJJYNv Reoyb3y8JJlENIP+G7HCE5HIkOhgX4QYul0X1zFkkviQ3sX0cn3Rvxderhhv+O0h NkoOl+OdPfVHFguITjWhUBwj20tH+W+J8tRhJoULVT7QjCrGNSWffodt6YamqTU= =bPJD -----END PGP SIGNATURE----- --hbFHJNpTqKsmahAq7PsaSNk4dIGJtkTDt-- From nobody Thu Aug 31 17:47:47 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81D1E1330B3 for ; Thu, 31 Aug 2017 17:47:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.88 X-Spam-Level: X-Spam-Status: No, score=-1.88 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oOPlkJpLUfFz for ; Thu, 31 Aug 2017 17:47:43 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A757F1330AD for ; Thu, 31 Aug 2017 17:47:43 -0700 (PDT) Received: from Orochi.local (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id v810lZIO066189 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 31 Aug 2017 19:47:36 -0500 (CDT) (envelope-from adam@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be Orochi.local To: Stephen Farrell , Ben Schwartz , acme@ietf.org References: From: Adam Roach Message-ID: <85c8aa7f-52a6-38fc-3700-d8607103889d@nostrum.com> Date: Thu, 31 Aug 2017 19:47:30 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Acme] On draft-ietf-acme-ip X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Sep 2017 00:47:46 -0000 On 8/31/17 19:25, Stephen Farrell wrote: > I really like the idea that the acme WG aims to figure out a way to > enable people at home to use https with their home n/w routers. > > I'm not at all sure that a DNS-based approach here will cut the > mustard, though it's a not-bad plan to define one in any case. > > I'd love that we chat about this topic involving folks from the acme > and homenet WGs, as it seems those are the sets of IETF folks who > might be most relevant for the discussion. There was some musing at the W3C TPAC in Lisbon last year on this topic. The tricky part is figuring out what kind of model makes sense for the certs at all. I suspect we'd need to come to some agreement on that issue before trying to work out how ACME can be used to issue them. There's some background reading at , mostly in the form of slide decks. /a From nobody Thu Aug 31 19:58:57 2017 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D4E1132F13 for ; Thu, 31 Aug 2017 19:58:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2WCMK80caQto for ; Thu, 31 Aug 2017 19:58:54 -0700 (PDT) Received: from mail-oi0-x22a.google.com (mail-oi0-x22a.google.com [IPv6:2607:f8b0:4003:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9523D132F12 for ; Thu, 31 Aug 2017 19:58:54 -0700 (PDT) Received: by mail-oi0-x22a.google.com with SMTP id n18so8364128oig.2 for ; Thu, 31 Aug 2017 19:58:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=LlmeUX6E353NfCYgKbA25nCI/czfwunTA5B1s2/y+t8=; b=fQADJpPKxNBK3+QgH3hdkqkrpWCtuQEJFxQ+rzkcWztHvYR5dfODJbx8M7+/yl1F0C ovzSP1brGM/sjZHggvups0BrF1AAXmNtoGm6vFgXeJWtlhN78iyHiCbc1U4Dm2WTA/tQ qM4kM2tUKPwN8spiKdbGtE+0n+yNytPxL26L6JXUYB8MqgIhWn85E9nXuw71NgxRhpxJ Rki5H0ic2Unyx2PM8WEkWZRlE4aUjAMRF6K/Bg2dQBGS3Ruka2ib0iA/AGidVzXzMYPY 1weDHHp7q4QXkfhZkhTV31h6/9HB9O5Gkcy7RKe4Afmbvu1F1kGTenH2C7i+VdmdBu7X lOKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=LlmeUX6E353NfCYgKbA25nCI/czfwunTA5B1s2/y+t8=; b=nxHmFv5UFLPd84XnfOJrUVnbrNpUgKeDOq8sU3JTIKHlrNdyZ0XeI70tbJX5aJQ6/P q5OEOvQNep7CPGZjGoYNi7p8jK+JByxyhX0rOaK4AmT95PHaZb8NJwJTbUA858o/knU6 uUtXEuhIC/3hu4WVWz1CX/I7UUmRy9FH3Y1jne0GjhzJT7P8/wfLw4L177i8eNPpldd+ r+Zw5Sh1TK0Rztq8sMn8uQh+ysQRvBbJni4kV4Y4cmS6cDzXsDP8Y9saxZq7k6quMCI3 CI8nT4bDvnul8G6Aw4i+GXwRjSy6nnJfDs6zTNcpSJTd0l+pZRlxA1zUrfxGKdCIaAwW VFLQ== X-Gm-Message-State: AHPjjUgaWsAFZChOXgotlTx2qDilygrmKyHG8QhsiHmtYO1CsibHi3o6 dyBVN4z19RNpyErQI7mNp55HlQDggQ== X-Google-Smtp-Source: ADKCNb5+TFnfvjKUCBaNdEPo0NF+7T9nI7ojOSAMKMm1CrdrgwC/YUfpb+xEKuR1rwWTZCnLZ0756bcoj3WcwfT9IUc= X-Received: by 10.202.4.130 with SMTP id 124mr600328oie.246.1504234733683; Thu, 31 Aug 2017 19:58:53 -0700 (PDT) MIME-Version: 1.0 Received: by 10.157.63.163 with HTTP; Thu, 31 Aug 2017 19:58:53 -0700 (PDT) In-Reply-To: <85c8aa7f-52a6-38fc-3700-d8607103889d@nostrum.com> References: <85c8aa7f-52a6-38fc-3700-d8607103889d@nostrum.com> From: Martin Thomson Date: Fri, 1 Sep 2017 12:58:53 +1000 Message-ID: To: Adam Roach Cc: Stephen Farrell , Ben Schwartz , "acme@ietf.org" Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Acme] On draft-ietf-acme-ip X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Sep 2017 02:58:56 -0000 On Fri, Sep 1, 2017 at 10:47 AM, Adam Roach wrote: > On 8/31/17 19:25, Stephen Farrell wrote: >> >> I really like the idea that the acme WG aims to figure out a way to enable >> people at home to use https with their home n/w routers. ... > There was some musing at the W3C TPAC in Lisbon last year on this topic. The > tricky part is figuring out what kind of model makes sense for the certs at > all. I suspect we'd need to come to some agreement on that issue before > trying to work out how ACME can be used to issue them. There's some > background reading at > , mostly in > the form of slide decks. I don't see acme-ip being the solution here. Everyone has - or could have - a 10.0.0.1. The same applies to .local (see below). The movement needs to come from the relying party side. Thanks for sharing the link Adam, I was not aware of this. For the benefit of folks in the galleries, the three talks discuss two options. The first two talk about providing *real* names for the devices (..com for example). The nice thing with that is that that solution already works today. With ACME, if the manufacturer is willing to answer the challenges, the device only needs some way to talk to the manufacturer when it wants a certificate, not have an actual online presence. (Insert usual concerns about the manufacturer going out of business, etc...) I'm not sure that I fully grok the last one, but it talks about an ACME-like protocol that is mediated by a browser. It also talks about creating certificates for non-unique names on .local, so I'm not sure that it's feasible. Not discussed here, but we've talked a bit about using key continuity for network-local devices and changing the "bad certificate" page we show on first connection (with a different page when a different key is presented by the device).