Re: [Acme] How automated should ACME be?

Phillip Hallam-Baker <phill@hallambaker.com> Mon, 01 December 2014 21:31 UTC

MIME-Version: 1.0
Sender: hallam@gmail.com
In-Reply-To: <000b01d00da9$f5cc37a0$e164a6e0$@icloud.com>
References: <000b01d00da9$f5cc37a0$e164a6e0$@icloud.com>
Date: Mon, 01 Dec 2014 16:31:35 -0500
Message-ID: <CAMm+LwhDJY6Ogozw759ZpwVLyJopBozr8fxax1C7OrU9w1CoZA@mail.gmail.com>
From: Phillip Hallam-Baker <phill@hallambaker.com>
To: Trevor Freeman <trevor.freeman99@icloud.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: http://mailarchive.ietf.org/arch/msg/acme/5YHh2NeUOkaQY3bTTousjpyC_d8
Cc: "acme@ietf.org" <acme@ietf.org>
Subject: Re: [Acme] How automated should ACME be?
Precedence: list

On Mon, Dec 1, 2014 at 4:01 PM, Trevor Freeman
<trevor.freeman99@icloud.com> wrote:

> ACME is establishing DV scoped RAs. Tying the authentication of the RA to a
> specific form of authentication seems a little retro. We need a strong form
> of authentication for the RA, but why don’t we tokenize the RA
> authentication to make ACME support multiple ways to authenticate?

+1

I don't see any reason to limit an enrollment protocol to one
particular validation scheme or for that matter one particular role.
If a protocol requires major redesign to support other validation
processes or S/MIME versus TLS then we are doing it wrong.

We are going to need the flexibility for IPR reasons if nothing else.

[Acme] How automated should ACME be? Trevor Freeman
Re: [Acme] How automated should ACME be? Phillip Hallam-Baker