Re: [Acme] Supporting off-line (manual) validation

"Salz, Rich" <> Mon, 27 July 2015 21:11 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id C04261B2C18 for <>; Mon, 27 Jul 2015 14:11:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id sjDVjDb9j1ar for <>; Mon, 27 Jul 2015 14:11:06 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 277881B2B37 for <>; Mon, 27 Jul 2015 14:11:06 -0700 (PDT)
Received: from (localhost []) by postfix.imss70 (Postfix) with ESMTP id 57B1B290FF; Mon, 27 Jul 2015 21:11:05 +0000 (GMT)
Received: from ( []) by (Postfix) with ESMTP id 39E45290FD; Mon, 27 Jul 2015 21:11:05 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;; s=a1; t=1438031465; bh=u9Tv+tyBlSNNV+7ibO8F8A2JOJAyHXPlPapOyRVSRKw=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=SQyAVKR6fbbpUTSHybdrwBnXopxc1SMT0k0XHfeEmoeoTyTPShKfvOk27DESsLOlb O9PyGCG8r1aVx56WJdy0rZF6BDzq7zqY6v39jDNLdit5LA+E877tSkhx0So5AXqIZK ulLgOWTocEeWcsKJbTje7gwVRTUYEg5n9v2Scc+c=
Received: from ( []) by (Postfix) with ESMTP id 1FDB68008B; Mon, 27 Jul 2015 21:11:05 +0000 (GMT)
Received: from ( by ( with Microsoft SMTP Server (TLS) id 15.0.1076.9; Mon, 27 Jul 2015 16:11:04 -0500
Received: from ([]) by ([]) with mapi id 15.00.1076.000; Mon, 27 Jul 2015 16:11:04 -0500
From: "Salz, Rich" <>
To: Ted Hardie <>
Thread-Topic: [Acme] Supporting off-line (manual) validation
Thread-Index: AdDIpxau18mKWy42SjGct0wDJn83uwAMgreAAAoyFRA=
Date: Mon, 27 Jul 2015 21:11:04 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <>
Cc: "" <>
Subject: Re: [Acme] Supporting off-line (manual) validation
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 27 Jul 2015 21:11:07 -0000

> I don't think I understand the IANA registry bit here.  Is the idea that FooCA registers something like FooCA-send-us-this-by-registered-mail, and when the challenge is received by a client it looks at the IANA registry for something it can parse into human interaction?  How is that better than a single "offline" challenge where the URL to check for the steps is in the response?

It lets a single "generic" client say "I don't understand the OmniPublish offline protocol"  Or lets CA vendors ship plugin libraries for a generic ACME client (such as distributed by LetsEncrypt org).  And yes, maybe it's not needed if the URL is something the human points their browser to.

> This seems fairly low on the priority list, honestly, but if we are going to do it, I think we need to have some thought to what happens at some of the larger time scales.  If months pass, the contact information may go stale, to take a simple example.

I think it's higher than that *if and only if* the commercial CA's find it something they could use.