Re: [Acme] Support for domains with redundant but not immediately synchronized servers

Hugo Landau <hlandau@devever.net> Tue, 01 December 2015 01:36 UTC

Return-Path: <hlandau@devever.net>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EE421B35F9 for <acme@ietfa.amsl.com>; Mon, 30 Nov 2015 17:36:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.112
X-Spam-Level:
X-Spam-Status: No, score=-0.112 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sN8cWHP7u4nM for <acme@ietfa.amsl.com>; Mon, 30 Nov 2015 17:36:53 -0800 (PST)
Received: from umbriel.devever.net (umbriel.devever.net [149.202.51.241]) by ietfa.amsl.com (Postfix) with ESMTP id ADD651B3612 for <acme@ietf.org>; Mon, 30 Nov 2015 17:36:39 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with ESMTP id D30971C855; Tue, 1 Dec 2015 02:36:38 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=devever.net; h= user-agent:in-reply-to:content-disposition:content-type :content-type:mime-version:references:message-id:subject:subject :from:from:date:date:received:received; s=mimas; t=1448933798; x=1467123159; bh=YCI7PQfdh/8QaejTG4JrXfKIQRzD6/mWY0C+WDSF+II=; b= YCEdi3av0/JPdtdZha1Xp7KCTZW7tBIH7CncWOvtVaMN/Rk3ygOcVdPTI4ZHK3v4 Arq+6oD35GhU9jgzK/L/6SfLkycbs1TCBlUqohsClGwzq22U3L+xto3InfwZVwxd KE5H3GEZNBczBtP0SZH78m0h/FLmmZUswk/P0obO9i3dqLvR6uWjzMAuXy9Q0lMM 4173l0gMXr0TWH1K6ouo448EjKO9awe0WQ+hKS5bI2YwmbfdsdpPcQ9bXukVFEHH DtjbW813xbpnv7QwayK5URDgf28E/8iVyzlgCoOMjMVfPaeLL4ca8my/JMi4B6Ls iMOj+u9wJLPG8jKgJiwy7Q==
Received: from umbriel.devever.net ([127.0.0.1]) by localhost (umbriel.devever.net [127.0.0.1]) (amavisd-new, port 10026) with LMTP id 0sCEG5UMfqjM; Tue, 1 Dec 2015 02:36:38 +0100 (CET)
Received: from andover (localhost [127.0.0.1]) by umbriel.devever.net (Postfix) with SMTP id 9B94E1C854; Tue, 1 Dec 2015 02:36:38 +0100 (CET)
Date: Tue, 1 Dec 2015 01:36:38 +0000
From: Hugo Landau <hlandau@devever.net>
To: acme@ietf.org, jonas@wielicki.name
Message-ID: <20151201013638.GA29577@andover>
References: <565C84A1.9040102@wielicki.name>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <565C84A1.9040102@wielicki.name>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/Bp9nvdyjv-KovAun8QDGgT8wrLU>
Subject: Re: [Acme] Support for domains with redundant but not immediately synchronized servers
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Dec 2015 01:36:55 -0000

> Is such a thing planned? Are there security reasons against doing
> this? Are there security reasons against doing this on a DNSSEC signed
> domain (which klausurschokola.de is)?

Personally, I wouldn't think it unreasonable to allow an ACME client to
request that a specific IP be used for the purposes of a challenge. The
server would then verify that that IP is one of the candidate IPs,
rather than selecting one at random. I don't see that this causes any
loss of security, so it seems like a sensible inclusion.