Re: [Acme] ACME or EST?

[Viktor Dukhovni <[e-mail]>]

> Not much tbh, far less than getting something that can be
> turned on by default. And ISTM that any of the reaosnable
> choices, about which we sometimes endlessly debate, all
> work.

I agree that the wire format (syntax) is less important than the
feature set (semantics).  In particular, there I'd like to see some
discussion of what kind of "proofs of control" should be acceptable
with a lights-out DV certification authority.

A certification authority that issues a cert to anybody who asks
without any evidence of domain control may employ the most cool
message syntax and still be a bad idea.

A certification authority that makes it too difficult for most
domains to prove the legitimacy of the request would be pointless.

A certification authority that always accepts the weakest form of
evidence even for domains that should be able to present stronger
evidence would be unfortunate by bringing everyone's security down
to the lowest common denominator.

In terms of protocol standards, sure, encodings need to be discussed
and message structures agreed, ...  However, at the end of the day,
the trade-offs that LE will make between security and usability
are what really counts.

-- 
	Viktor.