IETF Logo Mail Archive

[Acme] Re: draft-ietf-acme-dns-persist-02

Sebastian Robin Nielsen <sebastian@sebbe.eu> Sat, 26 September 2026 01:49 UTC

Received: from dns2.sebbe.eu (dns2.sebbe.eu [IPv6:2001:470:dff1:1:10::2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by mx.ietf.org (Postfix) with ESMTPS id AEB3D30 for <acme@ietf.org>; Sat, 26 Sep 2026 01:49:45 +0000 (UTC)
Authentication-Results: mx.ietf.org; dkim=pass header.d=sebbe.eu header.s=root header.b=jhtqGVds; dmarc=pass (policy=reject) header.from=sebbe.eu; spf=pass (mx.ietf.org: domain of sebastian@sebbe.eu designates 2001:470:dff1:1:10::2 as permitted sender) smtp.mailfrom=sebastian@sebbe.eu
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sebbe.eu; s=root; h=BIMI-Selector:Date:To:From:cc; bh=dYfUxfD3jLUZOllzo6sm0tpWBG55o2FHUrV5bHfZA5A=; b=jhtqGVdsfaFZ5wq8kkFRjhZNx6 yTN8nNCcV+2KsbsLux7JuM/URWJvgAJq0j5wIlZMf04by/xzcF6rMz0AYLKf5qQ0OXY3eMiafzCHR RipjQIvYJB5C3GL5Mi6xNOK9PKr6WlPKvvsU0obshGB7H0VazFUXtvd0A+uhXET+ASwp3+hA5b+pP nDeLyeX1SDdODRIlpMImy1/C+JChTwCSbFNaaPw+qCqNfdxr8RYzFjx/BirMVAHUiWf5P5U9PmcYC AbKWGORpb6SCizSqQip5HOANh4nqs+mA4/XdIgo3mVUqDuFLud4rqcVthOjS2+UexwZZlPjjdQipH ChNi/Ecw==;
Received: from localhost ([127.0.0.1] helo=sebastian-desktop) by sebbe.eu with esmtp (Exim 4_94_RC0-31-83e8da8c0-XX) (envelope-from <sebastian@sebbe.eu>) id 1xAHXh-001cPa-4X for acme@ietf.org; Sat, 26 Sep 2026 03:49:33 +0200
Received: from [192.168.1.180] (helo=DESKTOPSU6FAEM) by sebbe.eu with esmtpa (Exim 4_94_RC0-31-83e8da8c0-XX) (envelope-from <sebastian@sebbe.eu>) id 1xAHXg-001cPX-Om for acme@ietf.org; Sat, 26 Sep 2026 03:49:32 +0200
From: Sebastian Robin Nielsen <sebastian@sebbe.eu>
To: 'Mailing List' <acme@ietf.org>
Message-ID: <001601dd4d59$46f19b10$d4d4d130$@sebbe.eu>
In-Reply-To: <CAKh5S0aScJ96dDgjVUgae2fdubwU=ZvpPG0Jm87FSq-12aK3Lg@mail.gmail.com>
References: <97E486F9-10B6-461E-979F-64F157BEE648@fastly.com> <b74a848f-d408-40f1-8090-981d271646bd@gmail.com> <CAG0-MR8rYU__GysgbtuR3Wz9XXfFAsQrAMdjr8YBc7d+y_t64Q@mail.gmail.com> <CAKh5S0aScJ96dDgjVUgae2fdubwU=ZvpPG0Jm87FSq-12aK3Lg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="----=_Part_86_1532107586.1790387373101"
X-Mailer: Microsoft Outlook 16.0
Thread-Index: AQJUAZoo/cOCkh3dRaVhO6nIWL7vRwGFs4oVAoJtOSECD106cbXB8kYw
X-Encryption-Target: external
Date: Sat, 26 Sep 2026 03:49:33 +0200
BIMI-Selector: v=BIMI1; s=default
X-Spamd-Bar: -
Message-ID-Hash: 7KUWI5HYNW5LIVA7HN7XMA55UMUE7X2Z
X-Message-ID-Hash: 7KUWI5HYNW5LIVA7HN7XMA55UMUE7X2Z
X-MailFrom: sebastian@sebbe.eu
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-acme.ietf.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
Subject: [Acme] Re: draft-ietf-acme-dns-persist-02
List-Id: Automated Certificate Management Environment <acme.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/9JJk0YmwlAhgq3qS2GT4YLfKmEQ>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Owner: <mailto:acme-owner@ietf.org>
List-Post: <mailto:acme@ietf.org>
List-Subscribe: <mailto:acme-join@ietf.org>
List-Unsubscribe: <mailto:acme-leave@ietf.org>

Also, I do not think we should up the version number to dns-persist-02.

 

Since dns-persist-01 have ever only been in staging, so even if breaking changes are made, it will not harm a live site.

It will just harm people’s testing scripts and testing machines and testing sites.

 

No real (live) certificate have ever been issued using dns-persist-01 so I think we should keep it at dns-persist-01 even tough significant protocol changes are made.



The only reason to change the version number is if a sunset and overlap period is needed, so a ACME server or a client need to be able to speak both protocol variants at the same time.

Since dns-persist-01 have ever only been in staging, we could make the switch using a ”flag day”. Clients will get ample time to upgrade their protocol code since the ”new” variant of dns-perist-01 (with hashed URIs) will also be in staging for a period before going live in production.

 

 

Från: Matthew McPherrin <mattm=40letsencrypt.org@dmarc.ietf.org> 
Skickat: den 26 september 2026 02:08
Till: Henry Birge-Lee <henry=40crosslayerlabs.com@dmarc.ietf.org>
Kopia: Max Hearnden <maxoscarhearnden@gmail.com>; acme@ietf.org
Ämne: [Acme] Re: draft-ietf-acme-dns-persist-02

 

On Tue, Sep 22, 2026 at 6:07 PM Henry Birge-Lee <henry=40crosslayerlabs.com@dmarc.ietf.org <mailto:40crosslayerlabs.com@dmarc.ietf.org> > wrote:

The concern would probably be some storage attack on the CA by making a bunch of key rotations but this would have to be balanced with a comparable attack that could just come from making a bunch of new ACME account.

 

The registrations table for all Let's Encrypt accounts, ever, is under 350 gigabytes. We haven't even bothered to implement any sort of unused-account pruning in our production environment, though perhaps we will some day.

 

I'm not particularly worried about the storage aspect here, and if an account is misbehaving or otherwise acting maliciously, we can always just ban them.

v2.46.0 | Report a Bug | By Email | System Status