IETF Logo Mail Archive

Re: [Acme] Practical concerns of draft-ietf-acme-ari

Rob Stradling <rob@sectigo.com> Fri, 28 July 2023 09:26 UTC

Return-Path: <rob@sectigo.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AED29C14CE5F for <acme@ietfa.amsl.com>; Fri, 28 Jul 2023 02:26:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.008
X-Spam-Level:
X-Spam-Status: No, score=-7.008 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sectigo.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1TspCsflNAFJ for <acme@ietfa.amsl.com>; Fri, 28 Jul 2023 02:26:40 -0700 (PDT)
Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2066.outbound.protection.outlook.com [40.107.92.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6D87C14CE2C for <acme@ietf.org>; Fri, 28 Jul 2023 02:26:39 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TLmhjXAQCHodqGJjeLca/48g5flDOGCFx/kCd8hhbYnRvYfuRolKn/JNH2kgWsZYTqGMH8QlIlOMxOY1e3LhqW4hXnBjKbbNs08DM3eKrnGb7p1CQwDYP4GUBilAsVscGsZB7uw51CmGEYoZfLTF0i8EHLRJAAhN4/JTABn9YI2Jm7UgCx+v4YFwcuq8osP0HK58l9+9qPcsziCJfu5WbfiIriWuqGg5zDuDSqXSXZzDJN1UeFDA+MpxVUaTMzU7yRM7TBLn77vHigLG9U7jDEswZgqMjTVxVv7e80oCAmZxsrJqrzbej4T7V/by4JKph5TnfiEpawSyfiDBOb/1Sw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/C0LFT68l8QWK9QI6EFwq7+C3UNWxdYzorhE4He3lb8=; b=QuM19YJ/twwknMOGE3TiNO5VejbWcoDGqNgsstqxy36ROfZetfBU6FMGMlM02rhWygGQG9rHuzBixG5dlDvfTfCFsBO/MPPi27AkEWB7X7Az9JBMuGSNdB3qpVdTCHljXcnTS7uqtut3z7bT9HmltoZoYmsigSld8ocO/AwK3ST9babrTL75VMaI0HrTUYmWj8DlczB0LOh6ar49TAM4V/Hj0szq6x0g1bJJ14QTYWXkWEkfWd4VkFRyfDq9nKGYwRajqunP7LAvbIDz0xlV4Pi83OC/KuTu/RQU5cQm8vCnSx5pXDd5mJjrgHSsdYWBebsoDKxvWP4DGlpxEA8JHA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=sectigo.com; dmarc=pass action=none header.from=sectigo.com; dkim=pass header.d=sectigo.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sectigo.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/C0LFT68l8QWK9QI6EFwq7+C3UNWxdYzorhE4He3lb8=; b=KQ1cCFBpD68tET4I4EvwgWYBLv9kBE9w3t37kPOWO2tvKyFEPvJHhg4qexp796bRM1Ys4+POVHRXJENoV8tAuT3V1jXsJyGvdUJFDcb0dRcme1/fOSix7TMB9QnuyILb8oblNwJnQ9jNRrV/9qjl9NrkPN8JWzHCXGqEa6K4BJA=
Received: from MW4PR17MB4729.namprd17.prod.outlook.com (2603:10b6:303:106::18) by SJ0PR17MB5778.namprd17.prod.outlook.com (2603:10b6:a03:405::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6631.29; Fri, 28 Jul 2023 09:26:35 +0000
Received: from MW4PR17MB4729.namprd17.prod.outlook.com ([fe80::bf4f:f910:bb6f:f8ce]) by MW4PR17MB4729.namprd17.prod.outlook.com ([fe80::bf4f:f910:bb6f:f8ce%7]) with mapi id 15.20.6631.026; Fri, 28 Jul 2023 09:26:35 +0000
From: Rob Stradling <rob@sectigo.com>
To: Ilari Liusvaara <ilariliusvaara@welho.com>, "acme@ietf.org" <acme@ietf.org>
Thread-Topic: [Acme] Practical concerns of draft-ietf-acme-ari
Thread-Index: AQHZpe7WmdkZw0IL1EGdJOScH/LOca+rVGwAgBZ6EwCAAIjpgIAAR1EAgAA9FgCAABjCgIAJP7FwgABsNwCAAnNjZQ==
Date: Fri, 28 Jul 2023 09:26:35 +0000
Message-ID: <MW4PR17MB472910A4D0B37F0F4681A32AAA06A@MW4PR17MB4729.namprd17.prod.outlook.com>
References: <CAMML1Ajb8CHbPNqWK+afF0hJADxfxLXMG5Xoc9WL5tEUtwX+Xw@mail.gmail.com> <SN7PR14MB64921275EDE8DA4533381DCA832FA@SN7PR14MB6492.namprd14.prod.outlook.com> <CAEmnErdnGB3Jd-_GjsU0CpWOckwSHVVAyjzoxuFUp931+7pPVg@mail.gmail.com> <ZLjRGQaK8JS3kihW@LK-Perkele-VII2.locald> <CAGgd1OdbympHkmJkGBPvm2y+rGjNATPJoSrdG6MmxRQwXa8bUw@mail.gmail.com> <ZLlAKmRZdb8f8vdI@LK-Perkele-VII2.locald> <CAEmnErfJnmTvJX4M_Osji8LpSeD7jF6qMx29peMN6K0gN7WBUA@mail.gmail.com> <MW4PR17MB4729497927B40D3B9295A849AA00A@MW4PR17MB4729.namprd17.prod.outlook.com> <ZMFx4DmNpctPjoDZ@LK-Perkele-VII2.locald>
In-Reply-To: <ZMFx4DmNpctPjoDZ@LK-Perkele-VII2.locald>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=sectigo.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: MW4PR17MB4729:EE_|SJ0PR17MB5778:EE_
x-ms-office365-filtering-correlation-id: 24e34557-15a3-4bef-dee5-08db8f4cbd3a
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: ifx1mzcuWHdXNtyc/dDxBghArjTOjvCbpzlwoBkxdjGfluGF9fYwdfG3WD6b5HV4W2jteQm8+LIaEc88gYxfGp5vb+VcGQX3FdXIxod3vup1SZ0OSEbs/njj1rS7Q44BLoJzQTFPafbZn7BwQxzqWlfgmsniuLKserU+K4AFkKEoEpkW8FVRb/A1pWkpUe4Vui1C37xpJycSI64n+Ae0hWQix7XoDG/IDrTC2r4AzZ6QgPI9Kt9Wn6Qhsw/UyU1zWG5RBuMvwGwvUkfH1YHDUNVCrSLyyK1kMbiC7P0v0Y+zsQbvZQJ+AiwKFNPSPW92nptYIKYDfrWlu08KPux4YDwGDQWBrxwX7G47VW8G2WbH48370Yngnlo63FGYEMArYwLPRQ1TvNoVUYYn+zyKSv6JDAFxFkAhTgUPFxWMpPxU8uZm8Tx9sbBBZPKZsHXgozylz/j0Z0QGf9JWoEmKFrhgzFfXt5G4cT3I8NXV+DoaAlBsNx4SyoGrilbxaLtnjwlG3HJ4UQ+/2O0jVee6cQ1uk75+nW91PQHssYW+hCJuSpP/jnFCdOKkROSVLo/5/buT5oO8d6z4hgAFWP2Dx6TmgndcWlLx1JolqHST5rE=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MW4PR17MB4729.namprd17.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(396003)(346002)(366004)(39860400002)(136003)(376002)(451199021)(86362001)(122000001)(38070700005)(166002)(33656002)(19627405001)(71200400001)(55016003)(2906002)(110136005)(478600001)(38100700002)(26005)(53546011)(186003)(6506007)(41300700001)(966005)(8676002)(45080400002)(52536014)(9686003)(66946007)(316002)(7696005)(66556008)(66476007)(66446008)(76116006)(91956017)(5660300002)(64756008)(8936002); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: QaPo7CfRg+7YvGE75K1Nv9r3U1HDyCZxtFvI/KAQe+jtxrtFMvDWEpFAzFMs0z5rTddq85q+03Inrpg3KxRxiVps4eNVGE5AeNsKACIZednxLQPfSplntUN5A6mGS9E8aDmo6gafEbTVWCn8H5/mfxtw1Q4FfUYZJ1mGOrETbgp2Id2WyQaCMtE0yN6Y4ttTPRmM3eS7Dc3xkIcbx+945lDjDj/okgcLVsYsViELRO00LhNTEVJPaA1huMDLXtRwky+lH+L5BDPkaUv83UujcWt6LJHAucBhqdV0qnNd+araf2x46bmjLRmFpv3u8R+odfyvdLItyHzEqWmTlQ4kAS6O3J1WweWl2kQI2LnY/+27Q6X1KFRrzSiNJVe/U8ThZIAWJK9BFcNPuX2VGUoz6DemqLtxIiEyjfLSfMmiAUsfwPWjHPeNxMHCG7FjPgLlzcVJULDlUC1jtSL7LE4YcNSDZzkOxsWoiT1ENJBJJJAvDxu9vGkUTLVZk1ITy9lCIptKWOrmCwvXCGiq8QXH4Q79rO5WjabJqqh9Trj4KulXuQnGEXNNfD3A5fcS8d6DyFoiNQJ7DJxZRG09QxHiPgMBrlxPMfQHF1ENuzxR6FL+Va9jyybbP2FR3bSrWm95VwvXj4o2Yt42FKhEIEZbQ+sJH0chRIgUnGcIEVp+CDIpxTa9aglGwTlfA1A5BqzZX5b/z0xJpLYvkofWnb4bwelToT3PaOJJ3U1bQTGtdpGuCU+zbeefs8FJphW4j8QRKqSUMcyoITKGYMYzp2VXGTbaNqTfXUXXLZET8myN0FnlDuxxYMFuRE1XYq7F5wXqnIs5uVHrvRrHe721Oa5977YTzFabSWSPIvqsPDtmhH4MJrcfxzphyurrRir1gQDrFgS61wzNxue/ob+S2OimzWfnQ8u8pZ6EgjbRoF78alZMCon9qX36ZKOGd8Vi+gsc4exJ1a/68UmcWn1YmqM4MN/3bH9CLWg9qXN8k1fpkB8Tea0LMVoZ9dD9GlbZYLt5dBo1/NvYn6vOKvmFRS8IJcpA13/fVuAbxLrvQZoJaQg9o+03twbXURq5vDpLPHGgH73SoZRMBItmYNA1lfI5bv+22KFXmuvBKX67f5N6UQenpQtMl7DT4jllIwre3Kmnr+R9reziHBXFoOSRn2SQYxxzidAXzxGv0JF8xzJzvOELjdEDXc7dPVDvsmN6xVYcQ4D0WJYDqAuwHT/JWcacTU6IY8VKNFBpSEU3mVxxbND4eKc0LXr8V4c/ketDFzoloEvhpfJYnTsOehKyIMejWDhuu+6uPQC8NPEYg+4UV4W9qRA5I6Edz89rAqUDFwQH4Hcls9GY5kc/Ejdzz6Ot1oB00lyozolTFSmtfjBbYJK2CYgrFx5vs4ecPrP6yVQEc4rfdXyp/oEd4sJrjFjBLXcy3hd6L2+y9sGpbPJmR/7SClbRTGUlUIF4jpcCcn9nGWoxS4LBEryqzur3FO1ZG7/Lt3oFECYNgl6VB2I+9thDpjV9f8vSAYiPZXwFQzeCZJZeIZ+PeBJeJKFKftZxVa7z3R/Oo/flN9gn51FKPsQ=
Content-Type: multipart/alternative; boundary="_000_MW4PR17MB472910A4D0B37F0F4681A32AAA06AMW4PR17MB4729namp_"
MIME-Version: 1.0
X-OriginatorOrg: sectigo.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW4PR17MB4729.namprd17.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 24e34557-15a3-4bef-dee5-08db8f4cbd3a
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jul 2023 09:26:35.7997 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 0e9c4894-6caa-465d-9660-4b6968b49fb7
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: EAGQuQRgnbnCncL8XtJK2r2cimXBbBe6HjS9Nt3ySejA7M3zs0jmSj03mumLRaFem6Vc8Wya5Giu0t8doCxikw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR17MB5778
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/CLzFUL4tQL1CdQCXbmMmUC808vc>
Subject: Re: [Acme] Practical concerns of draft-ietf-acme-ari
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Jul 2023 09:26:45 -0000

> > Is it required that a CA's Subject DN must be globally unique?  No.
>
> RFC 5280, section 4.1.2.2:
> "It [the serial number] MUST be unique for each certificate issued by a
> given CA (i.e., the issuer name and serial number identify a unique
> certificate)."

Ah, so a CA's Subject DN does have to be globally unique then!  So if multiple independent "CAs" happen to share the same DN but have different keypairs, RFC5280 expects serial number uniqueness across the combined set of certificates issued by those independent "CAs".

> And a question: Is there anything in PKIX that bans two issuers with
> the same key but different name (that has happened) from issuing a
> certificate with the same serial number?

Not that I'm aware of.  If such a ban existed, I would expect to see it expressed in RFC 5280 section 4.1.2.2.

________________________________
From: Acme <acme-bounces@ietf.org> on behalf of Ilari Liusvaara <ilariliusvaara@welho.com>
Sent: 26 July 2023 20:20
To: acme@ietf.org <acme@ietf.org>
Subject: Re: [Acme] Practical concerns of draft-ietf-acme-ari

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


On Wed, Jul 26, 2023 at 03:56:12PM +0000, Rob Stradling wrote:

> Is it required that a CA's Subject DN must be globally unique?  No.

RFC 5280, section 4.1.2.2:

"It [the serial number] MUST be unique for each certificate issued by a
given CA (i.e., the issuer name and serial number identify a unique
certificate)."


And a question: Is there anything in PKIX that bans two issuers with
the same key but different name (that has happened) from issuing a
certificate with the same serial number?

I checked baseline requirements, I did not see anoything banning
that (albeit the entropy requirements make it unlikely).




-Ilari

_______________________________________________
Acme mailing list
Acme@ietf.org
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Facme&data=05%7C01%7Crob%40sectigo.com%7Caf13966ed697474a427908db8e0d5838%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638259960216266498%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=xO2oygJJk2A3WffYOuQUBXCHd1VoIRma0JTZ3yScgHU%3D&reserved=0<https://www.ietf.org/mailman/listinfo/acme>

v2.46.0 | Report a Bug | By Email | System Status