IETF Logo Mail Archive

Re: [Acme] Issue: Allow ports other than 443

Eliot Lear <lear@cisco.com> Tue, 24 November 2015 12:42 UTC

Return-Path: <lear@cisco.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E2DA1A1EFC for <acme@ietfa.amsl.com>; Tue, 24 Nov 2015 04:42:58 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.086
X-Spam-Level:
X-Spam-Status: No, score=-15.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.585, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fY1l5xJ-y2jY for <acme@ietfa.amsl.com>; Tue, 24 Nov 2015 04:42:57 -0800 (PST)
Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B40EA1A1EFB for <acme@ietf.org>; Tue, 24 Nov 2015 04:42:56 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2419; q=dns/txt; s=iport; t=1448368976; x=1449578576; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to; bh=bfkR9CvXFmlWT5NkagN26/myx5axRKK6SxGKBI33D4c=; b=TAAXr4NoIVA9jzGvVdnNGbQrkbKWixqhbRV7cu2Xkqt4E7jysqbmFjoW dt74njPvTgxqsvm2WYIVuCP1UftSDAMj+r2/oyN0HbZMdA+CagI3xdTG2 PYkt4/DSuNxZrpOOtDv04oxuztSZxON44RfNCjg9LaIso5cficn7odbZh Y=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CsBAA+WlRW/xbLJq1ehA5vwRcXCoVuAoICAQEBAQEBgQuENQEBBAEBASBLCgEQCw4KCRYLAgIJAwIBAgEVMAYBDAYCAQGIKg2uKpAwAQEBAQEBAQEBAQEBAQEBAQEBAQEBDwUEi1KEQoMzgUQFllCCWYFhaogNgVuEQIMCky5jhAU9NINjJYEjAQEB
X-IronPort-AV: E=Sophos;i="5.20,338,1444694400"; d="asc'?scan'208";a="608411776"
Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 24 Nov 2015 12:42:53 +0000
Received: from [10.61.163.56] ([10.61.163.56]) by aer-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id tAOCgrJh029935; Tue, 24 Nov 2015 12:42:53 GMT
To: Peter Eckersley <pde@eff.org>, Martin Thomson <martin.thomson@gmail.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org>
From: Eliot Lear <lear@cisco.com>
Message-ID: <56545B4C.3020406@cisco.com>
Date: Tue, 24 Nov 2015 13:42:52 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <20151124033325.GH18430@eff.org>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="fvhl53g608ERXlb31uLRa4vfjkcCxmxjx"
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/GagQb8mlUOas1PkV-tGeFqVAkHo>
Cc: IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>
Subject: Re: [Acme] Issue: Allow ports other than 443
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2015 12:42:58 -0000

Isn't this precisely what .well-known was meant to address?

Eliot


On 11/24/15 4:33 AM, Peter Eckersley wrote:
> +1 on both Rich's request and the IANA suggestion. 
>
> I think something that would help for this purpose would be an
> Internet-wide zmap scan of some plausible ports, to ensure there isn't
> anything in widespread use on them that could be a relevant attack
> surface for the challenge protocols.
>
> Anyone interested in volunteering to do some scans?
>
> On Mon, Nov 23, 2015 at 09:52:07AM -0800, Martin Thomson wrote:
>> Could we ask IANA for a reserved system port (<1024)?  Then it would
>> be possible for an ACME client to operate without disturbing running
>> services.
>>
>> On 23 November 2015 at 08:55, Russ Housley <housley@vigilsec.com> wrote:
>>> Allowing the Web server to continue running on 443 while validation takes place on another port seems like a straightforward resolution to the issue that is raised.
>>>
>>> Russ
>>>
>>>
>>> On Nov 21, 2015, at 1:03 PM, Salz, Rich wrote:
>>>
>>>> Please see here for the background: https://github.com/ietf-wg-acme/acme/issues/4
>>>>
>>>> But discuss this on the mailing list.
>>> _______________________________________________
>>> Acme mailing list
>>> Acme@ietf.org
>>> https://www.ietf.org/mailman/listinfo/acme
>> _______________________________________________
>> Acme mailing list
>> Acme@ietf.org
>> https://www.ietf.org/mailman/listinfo/acme
>>

v2.23.0 | Report a Bug | By Email