[Acme] Re: WG Last Call: draft-ietf-acme-dns-account-label-02 (Ends 2026-05-27)

[Shiloh Heurich <[e-mail]>]

I also reviewed draft -03 from the perspective of the Boulder and Pebble implementations I worked on and that Certainly uses. I support publication as written.
Regards,
Shiloh

> On Jul 3, 2026, at 09:00, [e-mail] wrote:
> 
> Hello,
> I reviewed -03 and think it's ready to ship. This method has been allowed by the CA/Browser Forum Baseline Requirements as validation method #21 for quite some time, and there are publicly trusted CAs that have implemented this draft. It would be good to move this along, absent glaring issues.
> 
> Thanks,
> Corey
> 
> 
>> On May 13, 2026, at 14:57, Mike Ounsworth via Datatracker <[e-mail]> wrote:
>> 
>> This message starts a WG Last Call for:
>> draft-ietf-acme-dns-account-label-02
>> 
>> This Working Group Last Call ends on 2026-05-27
>> 
>> Chair Note:
>> 
>> This document has essentially been done for 2 years and has active deployments. This WGLC is to gather a final round of review from the WG, and to see if anyone objects to moving it along and giving it an RFC number.
>> 
>> 
>> Abstract:
>>   This document outlines a new DNS-based challenge type for the ACME
>>   protocol that enables multiple independent systems to authorize a
>>   single domain name concurrently.  By adding a unique label to the DNS
>>   validation record name, the dns-account-01 challenge avoids CNAME
>>   delegation conflicts inherent to the dns-01 challenge type.  This is
>>   particularly valuable for multi-region or multi-cloud deployments
>>   that wish to rely upon DNS-based domain control validation and need
>>   to independently obtain certificates for the same domain.
>> 
>> File can be retrieved from:
>> 
>> Please review and indicate your support or objection to proceed with the
>> publication of this document by replying to this email keeping [e-mail]
>> in copy. Objections should be explained and suggestions to resolve them are
>> highly appreciated.
>> 
>> Authors, and WG participants in general, are reminded of the Intellectual
>> Property Rights (IPR) disclosure obligations described in BCP 79 [1].
>> Appropriate IPR disclosures required for full conformance with the provisions
>> of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any.
>> Sanctions available for application to violators of IETF IPR Policy can be
>> found at [3].
>> 
>> Thank you.
>> 
>> [1] https://datatracker.ietf.org/doc/bcp78/
>> [2] https://datatracker.ietf.org/doc/bcp79/
>> [3] https://datatracker.ietf.org/doc/rfc6701/
>> 
>> The IETF datatracker status page for this Internet-Draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/
>> 
>> There is also an HTMLized version available at:
>> https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-account-label-02
>> 
>> A diff from the previous version is available at:
>> https://author-tools.ietf.org/iddiff?url2=draft-ietf-acme-dns-account-label-02
>