Re: [Acme] kinds of proof (was: Re: ACME or EST?)

It is not clear to me that the form of the proof needs to be hard
coded into the enrollment protocol. It should certainly be possible to
layer in additional validation steps to support stronger validation.

On Fri, Nov 28, 2014 at 5:20 AM, Stephen Farrell
<stephen.farrell@cs.tcd.ie> wrote:
>
> changing subject line to the interesting bit...
>
> On 27/11/14 21:13, Viktor Dukhovni wrote:
>> I agree that the wire format (syntax) is less important than the
>> feature set (semantics).  In particular, there I'd like to see some
>> discussion of what kind of "proofs of control" should be acceptable
>> with a lights-out DV certification authority.
>
> Yep. Fully agree about DV. But DV isn't the only kind of
> validation I'd like to be supported here.
>
> I'd like if it were possible to extend that to include cases
> where one has control over the web server, but not the DNS.
>
> Now there are dangers in that so I'm not sure if it's really
> doable, but I've controlled web servers below tcd.ie for years
> (e.g. [1]), without any control over DNS, and I'd like to be
> able to do better than self-signed out of the box there too.
>
> The current spec [2] seems to allow for that via the "provision
> a file on the web server" method, but the details of that
> ("simpleHttps" I guess?) aren't clear. I'm also not sure of
> the security implications, which could be a killer (for having
> key authorization depend on this mechanism alone) so I'm sure
> there's work to be done there.
>
> But I'd very much like to just update apache on my servers
> and have that go get certs that work.
>
> S.
>
> [1] https://down.dsg.cs.tcd.ie/yesicanrichard.txt
> [2]
> https://github.com/letsencrypt/acme-spec/blob/master/draft-barnes-acme.md
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme