Re: [Acme] [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt

[Tim Hollebeek <[e-mail]>]

Some REALLY quick comments from a brief read:

First, I think this is pretty clearly standards track, especially since I expect
the authors are willing to work together with the IETF community and
respond to feedback, and it includes normative requirements that are
intended to be used with a major ecosystem, the WebPKI.

3.1.1. recommend clarifying the extent to which case matters.  How should
"TRUE" or "True" be handled?

4-5. This is WAY in the weeds, and possibly should just be ignored, but
there's actually no requirement that the CA is able to host content at
the domain specified in the CAA tag.  At a minimum, they're only required
to have permission from the domain owner (RFC 8659, first paragraph,
item 2, second clause).  This might actually even happen due to 
acquisitions.  In such situations, a CA might actually be unable to host
content on a .well-known URL for a tag it uses.

I don't think 8.4.1/2 is in scope or makes the document better.  There are a
wide variety of contractual solutions here, and how a user agrees to a
particular CA's terms of service is not a relevant topic for IETF.

-Tim

> -----Original Message-----
> From: Acme <[e-mail]> On Behalf Of Mike Ounsworth
> Sent: Thursday, July 6, 2023 10:54 AM
> To: [e-mail]
> Cc: Paul van Brouwershaven <[e-mail]>
> Subject: [Acme] FW: [EXTERNAL] New Version Notification for draft-
> vanbrouwershaven-acme-auto-discovery-00.txt
> 
> Hi ACME!
> 
> This is new business that we would like to add to the agenda for 117.
> 
> Thanks,
> ---
> Mike Ounsworth & Paul van Brouwershaven
> 
> -----Original Message-----
> From: [e-mail] <[e-mail]>
> Sent: Thursday, July 6, 2023 9:39 AM
> To: Mike Ounsworth <[e-mail]>; Paul van
> Brouwershaven <[e-mail]>
> Subject: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-
> acme-auto-discovery-00.txt
> 
> WARNING: This email originated outside of Entrust.
> DO NOT CLICK links or attachments unless you trust the sender and know the
> content is safe.
> 
> ________________________________________________________________
> ______
> 
> A new version of I-D, draft-vanbrouwershaven-acme-auto-discovery-00.txt
> has been successfully submitted by Paul van Brouwershaven and posted to
> the IETF repository.
> 
> Name:           draft-vanbrouwershaven-acme-auto-discovery
> Revision:       00
> Title:          Auto-discovery mechanism for ACME client configuration
> Document date:  2023-07-06
> Group:          Individual Submission
> Pages:          16
> URL:            https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-
> auto-discovery-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-vanbrouwershaven-acme-
> auto-discovery/
> Html:           https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-
> auto-discovery-00.html
> Htmlized:    https://datatracker.ietf.org/doc/html/draft-vanbrouwershaven-
> acme-auto-discovery
> 
> 
> Abstract:
>    A significant impediment to the widespread adoption of the Automated
>    Certificate Management Environment (ACME) [RFC8555] is that ACME
>    clients need to be pre-configured with the URL of the ACME server to
>    be used.  This often leaves domain owners at the mercy of their
>    hosting provider as to which Certification Authorities (CAs) can be
>    used.  This specification provides a mechanism to bootstrap ACME
>    client configuration from a domain's DNS CAA Resource Record
>    [RFC8659], thus giving control of which CA(s) to use back to the
>    domain owner.
> 
>    Specifically, this document specifies two new extensions to the DNS
>    CAA Resource Record: the "discovery" and "priority" parameters.
>    Additionally, it registers the URI "/.well-known/acme" at which all
>    compliant ACME servers will host their ACME directory object.  By
>    retrieving instructions for the ACME client from the authorized
>    CA(s), this mechanism allows for the domain owner to configure
>    multiple CAs in either load-balanced or fallback prioritizations
>    which improves user preferences and increases diversity in
>    certificate issuers.
> 
> 
> 
> 
> The IETF Secretariat
> 
> 
> Any email and files/attachments transmitted with it are intended solely for
> the use of the individual or entity to whom they are addressed. If this
> message has been sent to you in error, you must not copy, distribute or
> disclose of the information it contains. Please notify Entrust immediately and
> delete the message from your system.
> _______________________________________________
> Acme mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/acme