Re: [Acme] Server on >= 1024 port

moparisthebest <admin@moparisthebest.com> Wed, 25 November 2015 17:27 UTC

To: Eric Rescorla <ekr@rtfm.com>
References: <565589E4.2030107@desy.de> <5655EC72.7060300@moparisthebest.com> <CABcZeBOJ6O+P3U1EJoRkKaHaJVVBtLiQwpRp5aNOa+fX-noPjQ@mail.gmail.com>
From: moparisthebest <admin@moparisthebest.com>
Message-ID: <5655EFCF.9090403@moparisthebest.com>
Date: Wed, 25 Nov 2015 12:28:47 -0500
MIME-Version: 1.0
In-Reply-To: <CABcZeBOJ6O+P3U1EJoRkKaHaJVVBtLiQwpRp5aNOa+fX-noPjQ@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/SdIiGjPFBM4e7MTcTQnjCllnpQY>
Cc: IETF ACME <acme@ietf.org>
Subject: Re: [Acme] Server on >= 1024 port
Precedence: list

On 11/25/2015 12:15 PM, Eric Rescorla wrote:
> On Wed, Nov 25, 2015 at 9:14 AM, moparisthebest wrote:
>     Why shouldn't the client simply be able to tell the ACME server what
>     port to test, and the ACME server assume if the client has access to
>     ANY port on the server then it should be able to host ANY TLS service
>     on that server?
> 
> Because this doesn't match operational reality on a number of shared
> hosting systems.

That sounds like a problem for the sysadmin's who misconfigured those
shared systems?

A domain validated certificate doesn't and never has said "This entire
machine is controlled solely by the domains specified in this
certificate", instead it says "This particular service/port on this
server is authorized by this domain to provide this service, however
this machine or even this port (via SNI) could host plenty of other
services/domains as well"

[Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Roland Zink
Re: [Acme] Server on >= 1024 port Martin Thomson
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Stephen Farrell
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Eric Mill
Re: [Acme] Server on >= 1024 port Darren J Moffat
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Ángel González
Re: [Acme] Server on >= 1024 port Vincent Lynch