Re: [Acme] Well Known CA->client poll on port 80/443 in http-acme

Dirk-Willem van Gulik <dirkx@webweaving.org> Sun, 15 January 2017 14:41 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
From: Dirk-Willem van Gulik <dirkx@webweaving.org>
In-Reply-To: <20170115142931.GB26429@LK-Perkele-V2.elisa-laajakaista.fi>
Date: Sun, 15 Jan 2017 15:39:43 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <65DAC165-2700-4DA5-A492-28B1F2E60541@webweaving.org>
References: <9099A621-D460-47B6-9172-0984CF3A0DC8@webweaving.org> <20170115140330.GA26429@LK-Perkele-V2.elisa-laajakaista.fi> <6AEBC4C9-FA1B-4672-AE58-15C165722B30@webweaving.org> <20170115142931.GB26429@LK-Perkele-V2.elisa-laajakaista.fi>
To: Ilari Liusvaara <ilariliusvaara@welho.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/SuXuKTh_u-avkxy3Vv2rC9POaKE>
Cc: acme@ietf.org
Subject: Re: [Acme] Well Known CA->client poll on port 80/443 in http-acme
Precedence: list

> On 15 Jan 2017, at 15:29, Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
> 
> On Sun, Jan 15, 2017 at 03:11:32PM +0100, Dirk-Willem van Gulik wrote:
>> 
>>> On 15 Jan 2017, at 15:03, Ilari Liusvaara <ilariliusvaara@welho.com> wrote:
>>> 
>>> On Sun, Jan 15, 2017 at 02:50:37PM +0100, Dirk-Willem van Gulik wrote:
>>>> ….
>>> 
>>> That's not a new version. It is pre-WG version, published about 1.5
>>> years ago.
>> 
>> Ok - so I’ll ignore git - and will take the IETF latest as leading.
> 
> There actually is another git repo (ietf-wg-acme/acme) that contains the
> WG draft work. That one is a bit newer than ietf-04 (but shouldn't have
> significant changes).
> 
>>> Currently in acme spec, the only ways to do verification without port
>>> 80 are TLS-SNI-02 (uses port 443) and DNS-01 (no connections at all,
>>> relies on DNS exclusively).
>> 
>> Ok - and is there any reason why allowing one to specify the port
>> would not be an option/bad idea ?
> 
> The list of ports public CAs can use is pretty short (5 ports in fact).
> 
>> I am looking at the typical old school unix case - i.e. apache — where
>> one starts up as root and quickly chroots/setuid()s - and where the
>> servers are commonly deployed on port > 1024 by end users.
> 
> There actually are restrictions on what ports public CAs can use for
> authentication. These are:
> 
> - 80 (HTTP)
> - 443 (HTTPS)
> - 115 (SFTP; no, not _that_ SFTP [1])
> - 25 (SMTP)
> - 22 (SSH)
> 
> These limits are exactly so that unprivileged users don't bind
> daemons to the ports and use those to obtain certificates (the
> certificates are valid for all ports).

Just to make sure I understand the reasoning:

	CA Policy prohibits an ACME CA Server from fetching the token (authenticating) from a subscriber port > 1024 (or a port not an element of [80,443,115,25,22)) because an (on common  flavours of unix) an un(der)privileged) user may run a daemon on such a port.

Correct ? Just so I understand the tradeoffs made correctly when implementing/mitigating the root-risk on the webserver side.

You would not happen to know where these are documented (I’ve scanned CPS, SA and policy but no cookie yet).

Dw

[Acme] Well Known CA->client poll on port 80/443 … Dirk-Willem van Gulik
Re: [Acme] Well Known CA->client poll on port 80/… Ilari Liusvaara
Re: [Acme] Well Known CA->client poll on port 80/… Dirk-Willem van Gulik
Re: [Acme] Well Known CA->client poll on port 80/… Ilari Liusvaara
Re: [Acme] Well Known CA->client poll on port 80/… Dirk-Willem van Gulik
Re: [Acme] Well Known CA->client poll on port 80/… Ilari Liusvaara
Re: [Acme] Well Known CA->client poll on port 80/… Salz, Rich
Re: [Acme] Well Known CA->client poll on port 80/… Dirk-Willem van Gulik
Re: [Acme] Well Known CA->client poll on port 80/… Ilari Liusvaara
Re: [Acme] Well Known CA->client poll on port 80/… Dirk-Willem van Gulik
Re: [Acme] Well Known CA->client poll on port 80/… Ilari Liusvaara