Re: [Acme] Issue: Allow ports other than 443

Darren J Moffat <Darren.Moffat@Oracle.COM> Thu, 26 November 2015 12:05 UTC

Message-ID: <5656F55F.7050409@Oracle.COM>
Date: Thu, 26 Nov 2015 12:04:47 +0000
From: Darren J Moffat <Darren.Moffat@Oracle.COM>
Organization: Oracle Solaris Security
User-Agent: Mozilla/5.0 (X11; SunOS i86pc; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Yoav Nir <ynir.ietf@gmail.com>, Rob Stradling <rob.stradling@comodo.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org> <56545B4C.3020406@cisco.com> <CAMm+Lwg-MktfPZ0TkRgKsTan2dzDSHuaRsrCcfF-Y-HY6aTKmw@mail.gmail.com> <5656C49E.6070701@cisco.com> <5656E66B.3000803@cs.tcd.ie> <9DCF723A-8CE9-4732-9DEA-ED7EEBA362A9@gmail.com> <5656EEFA.6000109@cs.tcd.ie> <5656F075.1070704@comodo.com> <4BD49C12-4C5C-47D0-AA7A-68A402A0EA0F@gmail.com>
In-Reply-To: <4BD49C12-4C5C-47D0-AA7A-68A402A0EA0F@gmail.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/5DTUKMD6brZ2UPg2w9FeJIjVwQ0>
Cc: Phillip Hallam-Baker <phill@hallambaker.com>, Eliot Lear <lear@cisco.com>, IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>, Peter Eckersley <pde@eff.org>, Martin Thomson <martin.thomson@gmail.com>, Stephen Farrell <stephen.farrell@cs.tcd.ie>
Subject: Re: [Acme] Issue: Allow ports other than 443
Precedence: list

On 11/26/15 11:50, Yoav Nir wrote:
>
>> On 26 Nov 2015, at 1:43 PM, Rob Stradling <rob.stradling@comodo.com> wrote:
>>
>> On 26/11/15 11:37, Stephen Farrell wrote:
>> <snip>
>>> True. A port-specific cert would only work with updated browsers
>>> which I guess is a fairly fatal objection to the idea. Ah well.
>>
>> Is it worth considering requiring proof of control of (some particular combination of) _multiple_ ports rather than just a single port?  Would that strengthen the validation in any meaningful way?
>
> Not really. I have user access (with shell) to the a bunch of Linux servers where I work. I can run programs and open any high port I want, but I can’t open ports below 1024.
>
> Running some script to run a web server on a bunch of high ports is trivial in a case like that. Of course “proper” environments won’t let anyone other than an administrator get shell access to a computer running a public-facing web server, but we can’t rely on all environments being properly run.

Nor can you rely on "properly run" environments all enforcing the 
traditional UNIX privileged port concept of < 1024.  The whole idea that 
< 1024 is special is pretty close to pointless in the modern world if 
you are looking from the outside of the machine.

There are also plenty of cases I can think of where I need a single 
certificate for TLS but port 443 is only one of the possible ports that 
certificate will be used on.  I also have use cases for the TLS server 
sometimes being a TLS client of another TLS server and it is very 
desirable to use the same certificate when being the client or server.

-- 
Darren J Moffat

[Acme] Issue: Allow ports other than 443 Salz, Rich
Re: [Acme] Issue: Allow ports other than 443 Russ Housley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Douglas Calvert
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Hugo Landau
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Kathleen Moriarty
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Phillip Hallam-Baker
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Rob Stradling
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Darren J Moffat
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear