Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt

[Carl Wallace <[e-mail]>]

The example is good, but it doesn’t quite get at the issue. I think the problematic text is “if no common CA is found.” In the example, there is a common CA, there are just different priorities. It does help clarify the “as few domains” part though. Maybe something like “if all domains do not prefer the same CA, the ACME client tries…” would be more clear.

 

From: Paul van Brouwershaven <[e-mail]>
Date: Wednesday, July 12, 2023 at 2:30 PM
To: Carl Wallace <[e-mail]>, Mike Ounsworth <Mike.Ounsworth=[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt

 

>> - In 5.1, what does 3.b mean? Can you add an example?
> I will try to add an example here.

 

Does this example help to clarify the intend of 3.b?

https://vanbroup.github.io/acme-auto-discovery/draft-vanbrouwershaven-acme-auto-discovery.html#name-selecting-a-common-ca-throu

 

The other changes have also been incorporated.

 

From: Paul van Brouwershaven <[e-mail]>
Sent: Wednesday, July 12, 2023 18:16
To: Carl Wallace <[e-mail]>; Mike Ounsworth <Mike.Ounsworth=[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt 

 

Thanks for your detailed review!

- Why is the draft informational and not standards track?

Most people I spoke to, while discussing the idea, thought that it would need to be information, but if people here feel that this needs to be changed to standards track, I'm fine with that too. I'm relatively new to the drafting process.

- Why does absence turn the feature on? Wouldn't this invite sending spurious requests for ACME information to CAs configured before this draft existed that do not support ACME?

The reason is that with the move to shorter live certificates, automation will become essential. If we default to off, we will likely only see CAA records with this option enabled.



The benefit of these spurious requests is that it would give a clear signal to these CAs that they might need to adopt ACME and/or auto discovery, something that is also pushed by the root programs.



If an account binding is required (which is the case for most commercial CAs) the user will be asked to establish this binding, but no certificates will be issued until the account binding is established. When no account binding is required, the certificate will automatically be replaced by the authorized CA.



See also the security considerations in section 8.1.

- Is a boolean the right type for discovery or should it be a string that indicates the protocol that is the target of auto-discovery?

The protocol is already indicated by the property (i.e., issue, issuewild, vmc, issuemail, etc.)

- Do/ought parent domains apply (as they do in CAA)? If not, it might be worth a few words since the usage here is different.

Yes they do, section 5 states "The ACME client initiates a DNS lookup to retrieve the CAA record(s) according to [RFC8659]", which specifies how CAA lookups need to be performed.

- In the next to last example in 3.2, why does EV without priority go first?

It should not, we updated the logic later, I will get this corrected by including a priority here as well.

- In 5.1, you might want to replace the long paragraph with bullets.

This is fixed on GitHub and will be included in the next release.

- In 5.1, what does 3.b mean? Can you add an example?

I will try to add an example here.

- You should expand QWAC on first use and maybe add an informational reference.

Yes, I will add the meaning of the abbreviations and maybe a reference there.



Thanks,



Paul



From: Carl Wallace <[e-mail]>
Sent: Wednesday, July 12, 2023 17:48
To: Mike Ounsworth <Mike.Ounsworth=[e-mail]>; [e-mail] <[e-mail]>
Cc: Paul van Brouwershaven <[e-mail]>
Subject: Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt 

 

This looks like a useful addition. Here are a few comments and questions:

- Why is the draft informational and not standards track?

- Why does absence turn the feature on? Wouldn't this invite sending spurious requests for ACME information to CAs configured before this draft existed that do not support ACME? 

- Is a boolean the right type for discovery or should it be a string that indicates the protocol that is the target of auto-discovery?

- Do/ought parent domains apply (as they do in CAA)? If not, it might be worth a few words since the usage here is different.

- In the next to last example in 3.2, why does EV without priority go first?

- In 5.1, you might want to replace the long paragraph with bullets. 

- In 5.1, what does 3.b mean? Can you add an example?

- You should expand QWAC on first use and maybe add an informational reference. 


On 7/6/23, 10:54 AM, "Acme on behalf of Mike Ounsworth" <[e-mail] <mailto:[e-mail]> on behalf of Mike.Ounsworth=[e-mail] <mailto:[e-mail]>> wrote:


Hi ACME!


This is new business that we would like to add to the agenda for 117.


Thanks,
---
Mike Ounsworth & Paul van Brouwershaven


-----Original Message-----
From: [e-mail] <mailto:[e-mail]> <[e-mail] <mailto:[e-mail]>>
Sent: Thursday, July 6, 2023 9:39 AM
To: Mike Ounsworth <[e-mail] <mailto:[e-mail]>>; Paul van Brouwershaven <[e-mail] <mailto:[e-mail]>>
Subject: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt


WARNING: This email originated outside of Entrust.
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.


______________________________________________________________________


A new version of I-D, draft-vanbrouwershaven-acme-auto-discovery-00.txt
has been successfully submitted by Paul van Brouwershaven and posted to the IETF repository.


Name: draft-vanbrouwershaven-acme-auto-discovery
Revision: 00
Title: Auto-discovery mechanism for ACME client configuration
Document date: 2023-07-06
Group: Individual Submission
Pages: 16
URL: https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-auto-discovery-00.txt__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_TyALA0c$  <https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-auto-discovery-00.txt__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_TyALA0c$ >
Status: https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-vanbrouwershaven-acme-auto-discovery/__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_ZJirVYA$  <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-vanbrouwershaven-acme-auto-discovery/__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_ZJirVYA$ >
Html: https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-auto-discovery-00.html__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_TfosM1M$  <https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-vanbrouwershaven-acme-auto-discovery-00.html__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_TfosM1M$ >
Htmlized: https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-vanbrouwershaven-acme-auto-discovery__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_WIL7M14$  <https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/draft-vanbrouwershaven-acme-auto-discovery__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_WIL7M14$ >




Abstract:
A significant impediment to the widespread adoption of the Automated
Certificate Management Environment (ACME) [RFC8555] is that ACME
clients need to be pre-configured with the URL of the ACME server to
be used. This often leaves domain owners at the mercy of their
hosting provider as to which Certification Authorities (CAs) can be
used. This specification provides a mechanism to bootstrap ACME
client configuration from a domain's DNS CAA Resource Record
[RFC8659], thus giving control of which CA(s) to use back to the
domain owner.


Specifically, this document specifies two new extensions to the DNS
CAA Resource Record: the "discovery" and "priority" parameters.
Additionally, it registers the URI "/.well-known/acme" at which all
compliant ACME servers will host their ACME directory object. By
retrieving instructions for the ACME client from the authorized
CA(s), this mechanism allows for the domain owner to configure
multiple CAs in either load-balanced or fallback prioritizations
which improves user preferences and increases diversity in
certificate issuers.








The IETF Secretariat




Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains. Please notify Entrust immediately and delete the message from your system.
_______________________________________________
Acme mailing list
[e-mail] <mailto:[e-mail]>
https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/acme__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_F-p648Y$  <https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/acme__;!!FJ-Y8qCqXTj2!a4X0nrc1_QemkMo4Rt42Ki79RTnygcbMk0rum9pgO9MatIOC543E09zHtIByD45cb1tDPUXikl8nTN2z2czGowi_F-p648Y$ >