IETF Logo Mail Archive

Re: [Acme] [Errata Held for Document Update] RFC8555 (6843)

Rob Sayre <sayrer@gmail.com> Mon, 15 January 2024 05:54 UTC

Return-Path: <sayrer@gmail.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC203C14F5FA for <acme@ietfa.amsl.com>; Sun, 14 Jan 2024 21:54:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vh1fLYRdtwHz for <acme@ietfa.amsl.com>; Sun, 14 Jan 2024 21:54:26 -0800 (PST)
Received: from mail-ej1-x629.google.com (mail-ej1-x629.google.com [IPv6:2a00:1450:4864:20::629]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7613C14F5E0 for <acme@ietf.org>; Sun, 14 Jan 2024 21:54:26 -0800 (PST)
Received: by mail-ej1-x629.google.com with SMTP id a640c23a62f3a-a2e0be86878so18100266b.1 for <acme@ietf.org>; Sun, 14 Jan 2024 21:54:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1705298065; x=1705902865; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=hk2LV0GY8eE29aXj+Ibn88/csBBnWBa6oHcLxMYuDMg=; b=LYACEHYThra4qBTikDP6pJ75pBrGwLNOB5L4vaonJCpNEckLJDhgpiYsamx2DXJUOe xXSKfUMmRRkOqg9OGUTExnBx6PSJqJu2/esc3WHTdHB+id57po5pRrye1R36K2+oCKCU gwvc17Tezopx/Rt6Yv5WV9GUM2BWFVC3GtVZelzwD7iaE9CSV4bpeIdW1NBSWjjXyJQM 3yNL4mgOMXQxiFNFcNB+5obLIa1q9hdx+rlEFyJTEB7zUlJW9x2CxQPjsN/ugFIhs/OE VWMSSSXjTaGsF8+nD5mTWFyprefIEccteLSAKzdW4m7aFQHiVrBck6LIgeDL+5PPK6jk PXdA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705298065; x=1705902865; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=hk2LV0GY8eE29aXj+Ibn88/csBBnWBa6oHcLxMYuDMg=; b=WtLn9SmXMqIR/gFegQspfMTLlz+Z0ES+RYYfyXi43EdNmYKqYBnNmjUxvhlTij9KfY NJgWDIDHHes4qKpI/2K5196XV02mnBAAcNmNabcGqyAi0lco1mn0cuxbWOp25H8gASzQ U5wLzVrcRtdrfzxXz2SIercaHnl5HijKDo3ek7n5PKhbRPML/c/Fj4afJvyXEeH40KNk q80XWuAMQqX8CeOZpHv1Le+3NbKnsqvuHWjUiJIuI1bOpucUjbsrravdZ0FxfrqxmJgA 5Nset2+x2w+mRFSKKabjmG2vKBQACTKyACLofs2Q4EU6jHMEmjZozh2Um5ipUOdt3y3E ThWQ==
X-Gm-Message-State: AOJu0YwVOuPNDGzxOwDc2/yHm615+f2hfVbtnS2z1+mkHibsoOqwxtJR +I+W2iax+FauUlQ20giHKx0AbFyrQ5BXDFcebQs=
X-Google-Smtp-Source: AGHT+IGMY7cT1HMmxfhFhLPhkXMjOWhbK1eTwWI4NSrPbtKvMzg12LVTaVxIMJkj1ZmaLx7HP2uIDfYonLS3EHZUBFM=
X-Received: by 2002:a17:907:a688:b0:a2c:df12:272b with SMTP id vv8-20020a170907a68800b00a2cdf12272bmr3913796ejc.75.1705298065012; Sun, 14 Jan 2024 21:54:25 -0800 (PST)
MIME-Version: 1.0
References: <CAChr6SypX6PN_00OQUzRbtyXeQYsuVeZeRjg9Xosk8uRTkzr2Q@mail.gmail.com> <CAEmnErfE=-HMKkf4MHUfYCLam0baWA+QnAA7tg_tREtPFvRhdQ@mail.gmail.com> <CAChr6SzGo-4RZ0TwfqcJhy4FzL53LmsWHpe9EmN5eN_GDhdLzw@mail.gmail.com> <CAOG=JU+YFE826M7aW_KJRXNw639QjvVgH4WryPJ++Xq+BGS+Uw@mail.gmail.com> <CAChr6Syg80PWYDBDA872gyUkPoVKWvr2zsRmOUs16mGawQPa6g@mail.gmail.com> <CAGgd1Oc2=yXQvw+0sLZ+q5FKeg8N7_jxC-MdjaV9pjsmCNaEow@mail.gmail.com> <CAChr6SwAYSn4eEVvnce7XR18G8KPixFG_BbHRKzSKMrkEv4Nig@mail.gmail.com> <CAEmnErdY9umopZBBy4i6-2WcZotkopKquDPTRfaTCnURL49t=w@mail.gmail.com>
In-Reply-To: <CAEmnErdY9umopZBBy4i6-2WcZotkopKquDPTRfaTCnURL49t=w@mail.gmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Sun, 14 Jan 2024 21:54:13 -0800
Message-ID: <CAChr6Swap48ZkNRxxkdqQ_2YSgDzg4CG-dJGdJUiA05GYzBOMw@mail.gmail.com>
To: Aaron Gable <aaron@letsencrypt.org>
Cc: Deb Cooley <debcooley1@gmail.com>, IETF ACME <acme@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000066beeb060ef5a582"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/0G-6Q-HA8be5Sz5fJR_iW7WLCo8>
Subject: Re: [Acme] [Errata Held for Document Update] RFC8555 (6843)
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Jan 2024 05:54:29 -0000

On Sun, Jan 14, 2024 at 9:12 PM Aaron Gable <aaron@letsencrypt.org> wrote:

> On Sun, Jan 14, 2024, 10:12 Rob Sayre <sayrer@gmail.com> wrote:
>
>> On Sun, Jan 14, 2024 at 3:01 AM Deb Cooley <debcooley1@gmail.com> wrote:
>>
>>> I had this marked as 'hold for update' (vs. 'verified').  I can't tell
>>> from the discussion how you think we should be handling it.
>>>
>>
>> The erratum says "the challenge must be initiated over HTTP, not HTTPS.",
>> which is a little better than the current draft, in my opinion.
>>
>
> To be clear, the document being discussed is not a draft, it's a full RFC
> which was finalized five years ago.
>

That's twice now. Just stop with this stuff. Do you seriously think I don't
understand IETF procedures?

While you're correct that HSTS preload lists (there are multiple) are not
> just for browsers, they are just for the applications and platforms that
> maintain them. ACME clients do not generally run on such platforms, they
> usually run on server operating systems. They are under no obligation to
> use any HSTS preload list (which are not part of the HSTS spec), if there
> even was an obvious list for them to use.
>

Your protocol is insecure.

thanks,
Rob

v2.23.0 | Report a Bug | By Email