Re: [Acme] kinds of proof

[Viktor Dukhovni <[e-mail]>]

On Sat, Nov 29, 2014 at 09:22:08AM -0800, Paul Hoffman wrote:

> > Paul, do you have any examples of CAs that accept any port, or are
> > you in part making that up?

Sorry about that, intended to be a harmless off-the-cuff question,
a poor choice of words no doubt.

> When I got a cert for my POP server, what-used-to-be-Verisign
> required the proof of control to be on a port that was not 80.

So they did DV not by email verification, or HTTP, but rather
actually connected to a POP server or similar?

It seems to me that control over something other than ports 25, 80
or 443 is a rather risky choice, and at some point one actually
needs to verify domain control, rather than some arbitrary TCP
endpoint on the host.

> However, "does someone allow it" is completely different than "should this
> new protocol force a business model on all CAs". In the specific case I
> am thinking about, I want a server that will run DNS over TCP to be able
> to get a certificate with ACME. For that, the ability to control port 80
> on the host is completely irrelevant. The same would be true for IMAP and
> POP servers. There are plenty non-web uses of TLS where ACME could be
> useful; hobbling the protocol to be web-only seems premature.

Sure, and the domain owner can field servers on whatever port he/she
wishes after demonstrating control over the domain, which to me
means control over the DNS (be it direct, or indirect via whoever
administers the DNS).

-- 
	Viktor.