Re: [Acme] kinds of proof

[Paul Hoffman <[e-mail]>]

On Nov 29, 2014, at 9:05 AM, Viktor Dukhovni <[e-mail]> wrote:
> 
> On Fri, Nov 28, 2014 at 01:57:55PM -0800, Paul Hoffman wrote:
> 
>>> Because unfortunately, Web PKI certificates are host-wide, they don't
>>> specify a port.  Anyone who can run some program on a machine can
>>> bind to some random port and start a web service.  Possibly port-forwarded
>>> somewhere else via SSH!
>>> 
>>> It is far from clear to me that every "shell" user of a machine
>>> should be authorized to obtain certificates for the whole machine.
>> 
>> And it is clear to me that they should be, if we want to see more encryption
>> of traffic. I have no problem with some CAs saying "we'll issue you a cert
>> only if you control port X", but I absolutely want that to be a policy of
>> the CA, not of the enrollment protocol.
> 
> Paul, do you have any examples of CAs that accept any port, or are
> you in part making that up?

When I got a cert for my POP server, what-used-to-be-Verisign required the proof of control to be on a port that was not 80.

However, "does someone allow it" is completely different than "should this new protocol force a business model on all CAs". In the specific case I am thinking about, I want a server that will run DNS over TCP to be able to get a certificate with ACME. For that, the ability to control port 80 on the host is completely irrelevant. The same would be true for IMAP and POP servers. There are plenty non-web uses of TLS where ACME could be useful; hobbling the protocol to be web-only seems premature.

--Paul Hoffman