[Acme] Alexey Melnikov's Discuss on draft-ietf-acme-star-09: (with DISCUSS and COMMENT)

[Alexey Melnikov via Datatracker <[e-mail]>]

Alexey Melnikov has entered the following ballot position for
draft-ietf-acme-star-09: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-acme-star/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

Thank you for this well written document.

I have one small issue that I would like to discuss before recommending approval of this document:

Section 6.4 and 6.6 don’t seem to specify IANA registration procedure for new subregistries.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

1.1. Name Delegation Use Case

The proposed mechanism can be used as a building block of an efficient
name-delegation protocol, for example one that exists between a CDN or a cloud
provider and its customers [I-D.ietf-acme-star-delegation]. At any time, the
service customer (i.e., the IdO) can terminate the delegation by simply
instructing the CA to stop the automatic renewal and letting the currently
active certificate expire shortly thereafter. Note that in this case the
delegated entity needs to access the auto-renewed certificate without being in
possession of the ACME account key that was used for initiating the STAR
issuance.

Can you explain the last sentence? I am reading “in this case” as the delegated
entity needs access to renewed certificate once delegation is cancelled, which
doesn’t make sense. Please let me know if I misunderstood.