Re: [Acme] [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt

[Tim Hollebeek <[e-mail]>]

Oops, I forgot the most important one.  The draft ignores the existence of the
"issuewild" tag.  This won't work, because both issue and issuewild work together
in RFC 8659.  See, for example, section 4.3, third paragraph.  There's a requirement
to ignore "issue" records in certain circumstances, and it's not clear how that would
interact with the "issue" tags specified in this draft.  I think explicit consideration of
issuewild and how it would work together with this draft and RFC 8659 is needed.

This is especially important because ACME can be used in conjunction with the
 issuance of wildcard certificates, and this draft probably needs to specify how 
things work for that, too.

-Tim

> -----Original Message-----
> From: Acme <[e-mail]> On Behalf Of Tim Hollebeek
> Sent: Wednesday, July 12, 2023 4:32 PM
> To: Mike Ounsworth <Mike.Ounsworth=[e-mail]>;
> [e-mail]
> Cc: Paul van Brouwershaven <[e-mail]>
> Subject: Re: [Acme] [EXTERNAL] New Version Notification for draft-
> vanbrouwershaven-acme-auto-discovery-00.txt
> 
> Some REALLY quick comments from a brief read:
> 
> First, I think this is pretty clearly standards track, especially since I expect the
> authors are willing to work together with the IETF community and respond to
> feedback, and it includes normative requirements that are intended to be
> used with a major ecosystem, the WebPKI.
> 
> 3.1.1. recommend clarifying the extent to which case matters.  How should
> "TRUE" or "True" be handled?
> 
> 4-5. This is WAY in the weeds, and possibly should just be ignored, but there's
> actually no requirement that the CA is able to host content at the domain
> specified in the CAA tag.  At a minimum, they're only required to have
> permission from the domain owner (RFC 8659, first paragraph, item 2, second
> clause).  This might actually even happen due to acquisitions.  In such
> situations, a CA might actually be unable to host content on a .well-known
> URL for a tag it uses.
> 
> I don't think 8.4.1/2 is in scope or makes the document better.  There are a
> wide variety of contractual solutions here, and how a user agrees to a
> particular CA's terms of service is not a relevant topic for IETF.
> 
> -Tim
> 
> > -----Original Message-----
> > From: Acme <[e-mail]> On Behalf Of Mike Ounsworth
> > Sent: Thursday, July 6, 2023 10:54 AM
> > To: [e-mail]
> > Cc: Paul van Brouwershaven <[e-mail]>
> > Subject: [Acme] FW: [EXTERNAL] New Version Notification for draft-
> > vanbrouwershaven-acme-auto-discovery-00.txt
> >
> > Hi ACME!
> >
> > This is new business that we would like to add to the agenda for 117.
> >
> > Thanks,
> > ---
> > Mike Ounsworth & Paul van Brouwershaven
> >
> > -----Original Message-----
> > From: [e-mail] <[e-mail]>
> > Sent: Thursday, July 6, 2023 9:39 AM
> > To: Mike Ounsworth <[e-mail]>; Paul van
> > Brouwershaven <[e-mail]>
> > Subject: [EXTERNAL] New Version Notification for
> > draft-vanbrouwershaven- acme-auto-discovery-00.txt
> >
> > WARNING: This email originated outside of Entrust.
> > DO NOT CLICK links or attachments unless you trust the sender and know
> > the content is safe.
> >
> >
> ________________________________________________________________
> > ______
> >
> > A new version of I-D,
> > draft-vanbrouwershaven-acme-auto-discovery-00.txt
> > has been successfully submitted by Paul van Brouwershaven and posted
> > to the IETF repository.
> >
> > Name:           draft-vanbrouwershaven-acme-auto-discovery
> > Revision:       00
> > Title:          Auto-discovery mechanism for ACME client configuration
> > Document date:  2023-07-06
> > Group:          Individual Submission
> > Pages:          16
> > URL:            https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-
> > auto-discovery-00.txt
> > Status:         https://datatracker.ietf.org/doc/draft-vanbrouwershaven-acme-
> > auto-discovery/
> > Html:           https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-
> > auto-discovery-00.html
> > Htmlized:    https://datatracker.ietf.org/doc/html/draft-vanbrouwershaven-
> > acme-auto-discovery
> >
> >
> > Abstract:
> >    A significant impediment to the widespread adoption of the Automated
> >    Certificate Management Environment (ACME) [RFC8555] is that ACME
> >    clients need to be pre-configured with the URL of the ACME server to
> >    be used.  This often leaves domain owners at the mercy of their
> >    hosting provider as to which Certification Authorities (CAs) can be
> >    used.  This specification provides a mechanism to bootstrap ACME
> >    client configuration from a domain's DNS CAA Resource Record
> >    [RFC8659], thus giving control of which CA(s) to use back to the
> >    domain owner.
> >
> >    Specifically, this document specifies two new extensions to the DNS
> >    CAA Resource Record: the "discovery" and "priority" parameters.
> >    Additionally, it registers the URI "/.well-known/acme" at which all
> >    compliant ACME servers will host their ACME directory object.  By
> >    retrieving instructions for the ACME client from the authorized
> >    CA(s), this mechanism allows for the domain owner to configure
> >    multiple CAs in either load-balanced or fallback prioritizations
> >    which improves user preferences and increases diversity in
> >    certificate issuers.
> >
> >
> >
> >
> > The IETF Secretariat
> >
> >
> > Any email and files/attachments transmitted with it are intended
> > solely for the use of the individual or entity to whom they are
> > addressed. If this message has been sent to you in error, you must not
> > copy, distribute or disclose of the information it contains. Please
> > notify Entrust immediately and delete the message from your system.
> > _______________________________________________
> > Acme mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/acme
> 
> _______________________________________________
> Acme mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/acme