Re: [Acme] Issue: Allow ports other than 443

Yoav Nir <ynir.ietf@gmail.com> Thu, 26 November 2015 11:27 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <5656E66B.3000803@cs.tcd.ie>
Date: Thu, 26 Nov 2015 13:27:13 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <9DCF723A-8CE9-4732-9DEA-ED7EEBA362A9@gmail.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org> <56545B4C.3020406@cisco.com> <CAMm+Lwg-MktfPZ0TkRgKsTan2dzDSHuaRsrCcfF-Y-HY6aTKmw@mail.gmail.com> <5656C49E.6070701@cisco.com> <5656E66B.3000803@cs.tcd.ie>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/ACS6s-CZ27gS30DQBaLXGwG1yis>
Cc: Phillip Hallam-Baker <phill@hallambaker.com>, Eliot Lear <lear@cisco.com>, IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>, Peter Eckersley <pde@eff.org>, Martin Thomson <martin.thomson@gmail.com>
Subject: Re: [Acme] Issue: Allow ports other than 443
Precedence: list

> On 26 Nov 2015, at 1:00 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
> 
> 
> On 26/11/15 08:36, Eliot Lear wrote:
>> Yes.  The real issue here is that the cert contains the hostname and not
>> the port. 
> 
> So one could define a new always-critical certificate extension
> saying that the cert is only for use with some set of ports. (Or
> maybe someone's already defined it, I forget;-)

An extension - not that I know of, but as was mentioned in the other thread, there’s the URI subject alternate name. However, no current browsers look at this field, so the URI SAN provides no security from the privilege escalation. OTOH a critical extension would block *all* existing browsers from relying on such a certificate, with the only remedy being “Let’s Not Encrypt”.

It might be OK if the extension was added only to certificates issued to those who could not meet the challenge on port 443, but I still prefer to not go there.

Yoav

[Acme] Issue: Allow ports other than 443 Salz, Rich
Re: [Acme] Issue: Allow ports other than 443 Russ Housley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Douglas Calvert
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Hugo Landau
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Kathleen Moriarty
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Phillip Hallam-Baker
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Rob Stradling
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Darren J Moffat
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear