IETF Logo Mail Archive

Re: [Acme] [Errata Held for Document Update] RFC8555 (6843)

Rob Sayre <sayrer@gmail.com> Mon, 15 January 2024 12:41 UTC

Return-Path: <sayrer@gmail.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57608C14F5FA for <acme@ietfa.amsl.com>; Mon, 15 Jan 2024 04:41:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wt9QVmn_H2Gl for <acme@ietfa.amsl.com>; Mon, 15 Jan 2024 04:41:54 -0800 (PST)
Received: from mail-ej1-x633.google.com (mail-ej1-x633.google.com [IPv6:2a00:1450:4864:20::633]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C54B5C14F5ED for <acme@ietf.org>; Mon, 15 Jan 2024 04:41:54 -0800 (PST)
Received: by mail-ej1-x633.google.com with SMTP id a640c23a62f3a-a26f73732c5so1001163766b.3 for <acme@ietf.org>; Mon, 15 Jan 2024 04:41:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1705322513; x=1705927313; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=7uJ/S5kHAh0OKkgTTP5Ig/Ea/xcbYfLPzxnXDOBrrgU=; b=N1pqUjK2COZGHOvnIAiD6W0vE9IPTtXckUG8Ng1m0FT7uSnJsSTke0XSGD4we8jJkK yNxx5s3wdNF1xvF5fBcLfzTIf8ifmukuKBIDTNeJzzMt2vPML48K4arxgFPw37HoKLLt A47MMm1y9BlSy1kulHpjf0At6agMuL8athWiXRhvAkkJzQ/P9lR5GN680+MzhC8nKDGh IZlYkmOhBW4tyyRSofTxgczo2FbOtlPQ/bqgW9T4fgWfXshS24OSvuG57yxlOlIAQd1r 5xHwn2LNn2D90tXr5IrlHffhbEba79CF8uj42nxf7fB7d0j3pY85sy1/coQGj2N18vPe //XA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705322513; x=1705927313; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=7uJ/S5kHAh0OKkgTTP5Ig/Ea/xcbYfLPzxnXDOBrrgU=; b=dLUYOJCvQJKg2Tw6Jb8MWvINyd7flGOdVlRuVbr/+TThCFWDiHifsm04KNjZWDPF1b fXijacCRZzs7G5wYf+843nbEblZRuk2xOtkii2i9RWw2PngYSZW2RQ7W4TfAxogS43d4 VZYXIEUwDEra7kIeerJi35h9WFeDyJBFDrwMdRdAc2yLFgIVCUiRfSp0ko7jndxCBYwN ZUAM9z6wYtXXcSqn5gr/NXbYPIgfwG7KDORcFMib/lijZrBHg1tJQNSMMpF8IUXY/01G nG8I/x9jYbzI4KgZ97nLIHushqUcHOzvL9dVpcKPVtm0uQoVPosp4+pryHNafl68Y7eA 9BVA==
X-Gm-Message-State: AOJu0Yxg376qS68ugDqIf/UaRbDdyhJexuFHr5VITFceZgRKdoT82oxn /UhJgqopQq5M0xFzXSC7roxZ6vFdZ5lxFHzinwu/qU9Crms=
X-Google-Smtp-Source: AGHT+IEm4kkXwslKMev2itMCwgwrgZKIc26Vvpt9UjWHF767WKO3zhFiAMlo8wbX1x3R12+sBUk22RwXdRCYTMiggTY=
X-Received: by 2002:a17:906:b0c2:b0:a2e:57b:5186 with SMTP id bk2-20020a170906b0c200b00a2e057b5186mr404215ejb.125.1705322512624; Mon, 15 Jan 2024 04:41:52 -0800 (PST)
MIME-Version: 1.0
References: <CAChr6SypX6PN_00OQUzRbtyXeQYsuVeZeRjg9Xosk8uRTkzr2Q@mail.gmail.com> <CAEmnErfE=-HMKkf4MHUfYCLam0baWA+QnAA7tg_tREtPFvRhdQ@mail.gmail.com> <CAChr6SzGo-4RZ0TwfqcJhy4FzL53LmsWHpe9EmN5eN_GDhdLzw@mail.gmail.com> <CAOG=JU+YFE826M7aW_KJRXNw639QjvVgH4WryPJ++Xq+BGS+Uw@mail.gmail.com> <CAChr6Syg80PWYDBDA872gyUkPoVKWvr2zsRmOUs16mGawQPa6g@mail.gmail.com> <CAGgd1Oc2=yXQvw+0sLZ+q5FKeg8N7_jxC-MdjaV9pjsmCNaEow@mail.gmail.com> <CAChr6SwAYSn4eEVvnce7XR18G8KPixFG_BbHRKzSKMrkEv4Nig@mail.gmail.com> <CAEmnErdY9umopZBBy4i6-2WcZotkopKquDPTRfaTCnURL49t=w@mail.gmail.com> <CAChr6Swap48ZkNRxxkdqQ_2YSgDzg4CG-dJGdJUiA05GYzBOMw@mail.gmail.com> <CAGgd1Oc7Mb9FKZWxFFB3bYwR+b7g09u6bcGk6oVDQgPm6Fqg+A@mail.gmail.com>
In-Reply-To: <CAGgd1Oc7Mb9FKZWxFFB3bYwR+b7g09u6bcGk6oVDQgPm6Fqg+A@mail.gmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Mon, 15 Jan 2024 04:41:41 -0800
Message-ID: <CAChr6SzKxz+-E45YmGsQZVz9Vy377quBKMNXiAwfEKDJWgxgFA@mail.gmail.com>
To: Deb Cooley <debcooley1@gmail.com>
Cc: IETF ACME <acme@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000097b244060efb563c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/8CEp5REoRbhKI4MKBNhxrwfzW2c>
Subject: Re: [Acme] [Errata Held for Document Update] RFC8555 (6843)
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 15 Jan 2024 12:41:55 -0000

On Mon, Jan 15, 2024 at 3:42 AM Deb Cooley <debcooley1@gmail.com> wrote:

>   Items being brought up for discussion need to have specific and concrete
> examples within scope.
>

I think the issue is that the spec is not specific or concrete:

"Because many web servers
allocate a default HTTPS virtual host to a particular low-privilege
tenant user in a subtle and non-intuitive manner, the challenge must
be completed over HTTP, not HTTPS."

That sentence is very vague, and also seems to preclude HSTS as specified
in RFC 6797.*

I can understand that HTTP (rather than HTTPS) might need to be used
sometimes, but requiring it seems to conflict with HSTS, and enable the
exact attack HSTS aims to address. The erratum suggests a redirect, but
HSTS also aims to avoid that. At first, I thought there might be a
bootstrapping problem. But, if that were the case, the redirect in the
erratum wouldn't work either.

thanks,
Rob

* https://datatracker.ietf.org/doc/html/rfc6797

v2.23.0 | Report a Bug | By Email