IETF Logo Mail Archive

Re: [Acme] dns-01 challenge limitations

Simon Ser <contact@emersion.fr> Fri, 11 September 2020 13:21 UTC

Return-Path: <contact@emersion.fr>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB3A93A048D for <acme@ietfa.amsl.com>; Fri, 11 Sep 2020 06:21:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.101
X-Spam-Level:
X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=emersion.fr
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2XtC_N5wBRWB for <acme@ietfa.amsl.com>; Fri, 11 Sep 2020 06:21:24 -0700 (PDT)
Received: from mail-40134.protonmail.ch (mail-40134.protonmail.ch [185.70.40.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C32263A044A for <acme@ietf.org>; Fri, 11 Sep 2020 06:21:24 -0700 (PDT)
Date: Fri, 11 Sep 2020 13:21:17 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=emersion.fr; s=protonmail2; t=1599830482; bh=2dL8571Q/eaqPln4WGikRKdqYZUMqq/iu0SwME7eWXY=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; b=HiURGzqaSo7PiI54SXPgs2hCOBpgspUEn6scnt9pjIZQFOW2BDkS8sCkCH5ERX1+8 Bm7QJSEvP7IlwQStM7BAojUPSX7CSq4LVfggQ01S0+BU+WHFmReBkIHSksktY/Kp/3 awBYQVpFoznGMblLwesa+r18Kb2nnK6Xzvt9VqNoC+TJqQ3v+7S49HKKDMudiJzd/+ 5BeT1w23dZoneGxVAVPwjRBppIm4dIEEVWLuJtDXcAhhydAmbYBZT9uQN/WQGLdElq DSTnK8BZW11buFTDzABeSBpPBESLLKAkBxCLY5LowEUpSBBSBUIWzCsM2IqDxMIspc +oE7Ln+GdtvIg==
To: Philipp Junghannß <teamhydro55555@gmail.com>
From: Simon Ser <contact@emersion.fr>
Cc: "acme@ietf.org" <acme@ietf.org>, "Matthew.Holt@gmail.com" <Matthew.Holt@gmail.com>
Reply-To: Simon Ser <contact@emersion.fr>
Message-ID: <RIUPM_G4wCA2zxzlMxWZp78us6ljwnWaD3n4L4kRuxYeZkEudsnLnD4b6TllCoUoTlJy0FzcJIKQ5HHuNkYPWbrkmy6yGyDQPuYubQqsrQ8=@emersion.fr>
In-Reply-To: <CACHSkNq9D5tYpaYm+_336+7WkJxuRw6_zPgEUtfMqaqbDr+zww@mail.gmail.com>
References: <uu-OR5wP1b7svN1Rxems1U8_axHG7M8M9_kYqTBVyhQFxqrddppvhasyxKtLQ-4AZkrbBWhJ_9V-Xs8mQBK5E4smP4_1vANgZazIwicsbq0=@emersion.fr> <CACHSkNq9D5tYpaYm+_336+7WkJxuRw6_zPgEUtfMqaqbDr+zww@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/19gaXHepHmvJQwPWEP7V2FtPXBw>
Subject: Re: [Acme] dns-01 challenge limitations
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 11 Sep 2020 13:21:27 -0000

Hi,

On Friday, September 11, 2020 3:13 PM, Philipp Junghannß <teamhydro55555@gmail.com> wrote:

> I have asked that question in the LE forum iirc the problem is that
> someone could place that record once and as long as someone doesnt
> look at it all the time one can easily miss the fact that someone can
> create wildcards and stuff for that domain, so the point is to prove
> that dns access is given at the time of issuance.

If someone has once write access to the DNS, they can set an
acme-challenge record, redirect all requests, and issue wildcard certs.
That would be easy to miss, too.

> you could maybe use a different DNS Server which has a better API,
> and potentially even can be used by ACME.

The issue at hand isn't that a particular DNS registry operator isn't
supported by a particular ACME client. What I want to fix is the need
for all ACME clients to support all DNS registry operators.

Thanks,

Simon

v2.23.0 | Report a Bug | By Email