[Acme] Unqualified Domain names in ACME orders

[Xavier Landreville <[e-mail]>]

Hello,

currently, RFC8555 states (in section 7.1.4) that:

> The only type of identifier defined by this specification is a fully
>   qualified domain name (type: "dns").  The domain name MUST be encoded
>   in the form in which it would appear in a certificate.  That is, it
>   MUST be encoded according to the rules in Section 7 of [RFC5280].

This means that ACME (as specified) technically cannot be used for
unqualified domain names. While this is fine (and preferable) for
public CAs, internal/enterprise CAs might make use of unqualified
domain names for internal services and may want to generate
certificates using an internal ACME provider.

Certificates themselves don't have any restrictions as to whether
domain names must be qualified:
RFC5280 allows for dns names in the subject alternative names field
(Section 4.2.1.6), with the only requirement that the name be written
out as per the specification of RFC1034 section 3.5. That last RFC
does allow for domain names to contain only a label with no dots.

While many ACME server and client implementations already support
unqualified domain names in orders (and thus authorization objects),
there's at least one client implementation (Proxmox) that has refused
to implement unqualified domain names given the wording of the RFC.

Changing the wording of the definition of the "dns" identifier to drop
"fully qualified", and maybe adding a reference to the rules of
section 4.2.1.6 of RFC5280, would allow for unqualified domain names
to be meet the technical requirements of the RFC.

Happy to discus further.

Cheers,
Xavier