IETF Logo Mail Archive

Re: [Acme] Issuing certificates based on Simple HTTP challenges

Noah Kantrowitz <noah@coderanger.net> Wed, 16 December 2015 02:31 UTC

Return-Path: <noah@coderanger.net>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 462A01A1AAD for <acme@ietfa.amsl.com>; Tue, 15 Dec 2015 18:31:37 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.911
X-Spam-Level:
X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cr5sOV93PhBq for <acme@ietfa.amsl.com>; Tue, 15 Dec 2015 18:31:36 -0800 (PST)
Received: from mail.coderanger.net (coderanger.net [72.249.127.182]) by ietfa.amsl.com (Postfix) with ESMTP id BBE3D1A1AB5 for <acme@ietf.org>; Tue, 15 Dec 2015 18:31:34 -0800 (PST)
Received: from [10.255.146.165] (63-158-29-241.dia.static.qwest.net [63.158.29.241]) by mail.coderanger.net (Postfix) with ESMTPSA id 1624CA48006 for <acme@ietf.org>; Tue, 15 Dec 2015 21:31:34 -0500 (EST)
Content-Type: multipart/signed; boundary="Apple-Mail=_BB63367C-6428-42CE-A1FB-3FC7FB0EE3CB"; protocol="application/pgp-signature"; micalg="pgp-sha1"
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
X-Pgp-Agent: GPGMail 2.6b2
From: Noah Kantrowitz <noah@coderanger.net>
In-Reply-To: <5670CBD6.5080000@cs.tcd.ie>
Date: Tue, 15 Dec 2015 18:31:27 -0800
Message-Id: <A8E1A9D8-DA6A-48BC-B45C-DEC91D347412@coderanger.net>
References: <CAF+SmEpOLoaREymVhi=qOUg2opz1vKzzNp6tGrDTZAjYSKFDkg@mail.gmail.com> <566F15DC.7090607@wyraz.de> <6B677A87-C6A0-485E-80DF-24960D585F46@coderanger.net> <566F2CB5.90402@wyraz.de> <89774336-0BA6-48FC-821D-1E8F3ED9AC14@coderanger.net> <566F4701.7050308@wyraz.de> <F3DA31B1-B27C-4C63-8ED4-6D27D46FF282@coderanger.net> <C2C239F2-E8A7-499B-BE52-3A48EA92B86D@dropmann.org> <BF7F8411-3E83-4A1F-B3A1-4C37DC8B4618@coderanger.net> <3CDE1749-3143-49EE-BD66-0AE4A8CC4175@dropmann.org> <566FDAB7.2030403@cs.tcd.ie> <56700F68.3040103@wyraz.de> <56701904.2070009@cs.tcd.ie> <56702EFA.1050008@wyraz.de> <13B5E9A8-E9CE-4018-8A9D-7856CBF06B4F@coderanger.net> <CAMm+Lwhvf+nRVV38q1U1DKm1WStV1UJv4+EJ_zvq0G_Tb25S9w@mail.gmail.com> <2761E0B2-8DCC-4150-813F-8CAB756C0392@coderanger.net> <174B082E-2721-41AE-992D-2937DCCB74CB@dropmann.org> <5670CBD6.5080000@cs.tcd.ie>
To: "acme@ietf.org" <acme@ietf.org>
X-Mailer: Apple Mail (2.3112)
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/J7P9ZICqLM94wgwQJYIYZ7w8pxA>
Subject: Re: [Acme] Issuing certificates based on Simple HTTP challenges
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Dec 2015 02:31:37 -0000

> On Dec 15, 2015, at 6:26 PM, Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
> 
> 
> Hiya,
> 
> On 16/12/15 01:44, Julian Dropmann wrote:
>> The target users are server admins right? In order to set up their
>> services, they should be familiar with DNS.
> 
> Familiar with != has write access to.

Not to mention the multitude of automated tools that exist out in the world that know how to, say, point a domain A/CNAME/etc at Wordpress.com or Heroku or what have you. Being able to support transparent upgrades for all those people is a pretty big deal. Combine with stuff like end-point automation (the stuff I posted about a while ago) like the possibility of having Apache or Nginx at some point the future with a directly integrated ACME client so they just turn on HTTPS without you even knowing how. Tools in these situations act on the behalf of admins which may or may not grok DNS but they certainly don't have write access to it.

--Noah

v2.23.0 | Report a Bug | By Email