Re: [Acme] kinds of proof

[Paul Hoffman <[e-mail]>]

On Nov 28, 2014, at 9:09 AM, Viktor Dukhovni <[e-mail]> wrote:
> Related issues:
> 
>  * Does the web server have to be on port 443 with TLS enabled
>    (perhaps with a temporary self-signed certificate)?  Or is it
>    sufficient to control port 80 or some other port with or without
>    TLS?
> 
>  * If on port 443, is an existing certificate from any of the
>    usual public CAs (other than LE) (if also usable as a TLS client
>    cert to authenticate to the provisioning system) accepted as
>    evidence of authenticity for bootstrapping trust with LE?

Why should ability to control port 80 or 443 be a determinant for proving control of "web server" at "domain name"? Not all web service is run on port 80, and not all secure web service is run on port 443. A CA can validate that the requestor can control some HTTP service on some port at the domain name. If a CA has a policy that is more restrictive than that, ACME can trivially support that policy with more error codes.

>  * If the domain is DNSSEC signed, is it reasonable (I hope)
>    to raise the bar, and require proof of DNS control?  Since
>    bootstrapping with just web server control and no existing
>    credentials is vulnerable to MiTM, and signed domains are
>    making an effort to harden against such attacks?

I disagree that ACME-the-protocol should raise the bar past what we use for domain verification today. It's fine if a CA who uses ACME does.

--Paul Hoffman