From nobody Thu Aug 10 13:40:47 2023 Return-Path: X-Original-To: acme@ietfa.amsl.com Delivered-To: acme@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 196C6C1519A4 for ; Thu, 10 Aug 2023 13:40:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.106 X-Spam-Level: X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=letsencrypt.org Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fuvj6Mx-tmxa for ; Thu, 10 Aug 2023 13:40:42 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9BA39C1519A2 for ; Thu, 10 Aug 2023 13:40:42 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id d75a77b69052e-4039f7e1d3aso8888991cf.0 for ; Thu, 10 Aug 2023 13:40:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=letsencrypt.org; s=google; t=1691700041; x=1692304841; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :from:to:cc:subject:date:message-id:reply-to; bh=mROETV03cUr57yy3hFr7N52v0CET1C+6SgKTRxyxQF0=; b=STKQApvmNIWUDPd0gJS0/RikUnMeWja9cbkiR7FbfmYq7UMG7yu9rj39s6d2Tz7+CQ NBpVIopoTGqqb7S2tEK2aoSTSrYYEWNGMDYoza2XePT1wnCsMEruum3ehtG8Ilw8ZnD+ w7s9oBnDe9LYJIsXhs+2VQsr9iZArBSYhQ278= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1691700041; x=1692304841; h=to:subject:message-id:date:from:in-reply-to:references:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=mROETV03cUr57yy3hFr7N52v0CET1C+6SgKTRxyxQF0=; b=hqT+Obke1Lq9O6BBjN+Sys/lDTawB9fwTJqQEn7jLG62tVDsGHV576IxYF6XKFjK9M TFHkscA7LFjEZmaLzsqQGvoITQdMw3Dgxzkskdt4yMFAIgFQYcOdBxzT/JTAd+EyCBaq iEO64r4GxWswVzxJN0Me9SZU2lkK/QC0jyplqUJXG6aJ6XhcqbiSCXIvy3/ylUo/tFe0 ZbjMs5lDgKvq4yTiocuur+z0U74ufxR8pwYsr9fzh/gcVOqoN5kt8dOTaeV51uhzFyjW 1povN1B46WRywbQdbjwZvKsGPMGoHkXg6jNL5KBMO+864S31WOh1o3ZTbYH1M3wHEbsG bXHw== X-Gm-Message-State: AOJu0Yx2JVP6QZtxfmyrxDwE53MsChd4FodPiNiecSKNntSPyhpq0p/k RQITY30Eyc0ab6sGaOtxtUr8UUKcYrwucuAliENfn6CP74aC+Ba4S9Q= X-Google-Smtp-Source: AGHT+IHJEshsuLUa/sVH2365fSf4vfR5H+qs5d4KiHSLOnG60hUzJ4HhI3LaClKe7RhsSvYQaWXVD5vYJfNgx3V+pYg= X-Received: by 2002:a05:622a:1aa7:b0:406:cadc:ff35 with SMTP id s39-20020a05622a1aa700b00406cadcff35mr4212287qtc.54.1691700041352; Thu, 10 Aug 2023 13:40:41 -0700 (PDT) MIME-Version: 1.0 References: <169169957955.35995.6152684551733483476@ietfa.amsl.com> In-Reply-To: <169169957955.35995.6152684551733483476@ietfa.amsl.com> From: Aaron Gable Date: Thu, 10 Aug 2023 13:40:30 -0700 Message-ID: To: acme@ietf.org Content-Type: multipart/alternative; boundary="0000000000000820f00602979cc5" Archived-At: Subject: Re: [Acme] I-D Action: draft-ietf-acme-ari-02.txt X-BeenThere: acme@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: Automated Certificate Management Environment List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Aug 2023 20:40:47 -0000 --0000000000000820f00602979cc5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi all, This latest version of the ARI draft contains four material changes, based on feedback received in the lead-up to IETF 117: - The "Current Implementations" section is now up-to-date and lists multiple server and client implementations. - The "IANA Considerations" section has been updated to match the required format (to the best of my current understanding). - The format of the request URL has been simplified from the OCSP CertID structure to a concatenation of the AKID and Serial. See discussion and context at https://mailarchive.ietf.org/arch/msg/acme/AeJ3zJKcBF-ZUhQXJajC0bb7orI/, https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari= /200276, and https://github.com/aarongable/draft-acme-ari/issues/43. - The POST renewalInfo method has been replaced by a new optional field on New Order requests. See discussion and context at https://mailarchive.ietf.org/arch/msg/acme/AeJ3zJKcBF-ZUhQXJajC0bb7orI/, https://community.letsencrypt.org/t/thoughts-from-starting-to-play-with-ari= /200276, https://github.com/aarongable/draft-acme-ari/issues/50, and https://github.com/aarongable/draft-acme-ari/issues/25. These do represent backwards-incompatible changes that existing implementations will have to adopt, but I believe it is better to make such a change now than realize we specified it poorly later down the line :) Thanks, Aaron On Thu, Aug 10, 2023 at 1:33=E2=80=AFPM wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. This Internet-Draft is a work item of the Automated > Certificate > Management Environment (ACME) WG of the IETF. > > Title : Automated Certificate Management Environment (ACME) > Renewal Information (ARI) Extension > Author : None > Filename : draft-ietf-acme-ari-02.txt > Pages : 11 > Date : 2023-08-10 > > Abstract: > This document specifies how an ACME server may provide suggestions to > ACME clients as to when they should attempt to renew their > certificates. This allows servers to mitigate load spikes, and > ensures clients do not make false assumptions about appropriate > certificate renewal periods. > > The IETF datatracker status page for this Internet-Draft is: > https://datatracker.ietf.org/doc/draft-ietf-acme-ari/ > > There is also an HTML version available at: > https://www.ietf.org/archive/id/draft-ietf-acme-ari-02.html > > A diff from the previous version is available at: > https://author-tools.ietf.org/iddiff?url2=3Ddraft-ietf-acme-ari-02 > > Internet-Drafts are also available by rsync at rsync.ietf.org: > :internet-drafts > > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > --0000000000000820f00602979cc5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,

This latest version of the ARI = draft contains four material changes, based on feedback received in the lea= d-up to IETF 117:

- The "Current Implementati= ons" section is now up-to-date and lists multiple server and client im= plementations.

- The "IANA Considerations&quo= t; section has been updated to match the required format (to the best of my= current understanding).

- The format of the reque= st URL has been simplified from the OCSP CertID structure to a concatenatio= n of the AKID and Serial. See discussion and context at=C2=A0https= ://mailarchive.ietf.org/arch/msg/acme/AeJ3zJKcBF-ZUhQXJajC0bb7orI/, https://community.letsencrypt.org/t/thoughts-from-starting= -to-play-with-ari/200276, and https://github.com/aarongable/draft-acme-ari/issu= es/43.


These do represent backward= s-incompatible changes that existing implementations will have to adopt, bu= t I believe it is better to make such a change now than realize we specifie= d it poorly later down the line :)

Thanks,
Aaron

On Thu, Aug 10, 2023 at 1:33=E2=80=AFPM <internet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts
directories. This Internet-Draft is a work item of the Automated Certificat= e
Management Environment (ACME) WG of the IETF.

=C2=A0 =C2=A0Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Automated Cert= ificate Management Environment (ACME) Renewal Information (ARI) Extension =C2=A0 =C2=A0Author=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 : None
=C2=A0 =C2=A0Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-ietf-acme-ari-02.t= xt
=C2=A0 =C2=A0Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: 11
=C2=A0 =C2=A0Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 : 2023-08-10

Abstract:
=C2=A0 =C2=A0This document specifies how an ACME server may provide suggest= ions to
=C2=A0 =C2=A0ACME clients as to when they should attempt to renew their
=C2=A0 =C2=A0certificates.=C2=A0 This allows servers to mitigate load spike= s, and
=C2=A0 =C2=A0ensures clients do not make false assumptions about appropriat= e
=C2=A0 =C2=A0certificate renewal periods.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-ietf-acm= e-ari/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-iet= f-acme-ari-02.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddi= ff?url2=3Ddraft-ietf-acme-ari-02

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-dra= fts


_______________________________________________
Acme mailing list
Acme@ietf.org
https://www.ietf.org/mailman/listinfo/acme
--0000000000000820f00602979cc5--