[Acme] Trust and security in DNS challenge validation automation

[Joona Hoikkala <[e-mail]>]

While ACME tries to promote automation of the challenge validation, the
landscape of said automation looks rather grim. DNS server software and
service providers rarely provide means to limit the privileges of
credentials used to update DNS zones.

This leads to users being forced to use and save their credentials often
equipped with inflated privileges to every machine that needs to acquire
certificates using DNS challenges, effectively meaning that when one of
such machines gets compromised so does the whole DNS zone, or multiple
zones in some cases.

The issue can be somewhat alleviated by using a separate validation zone
that the user can point CNAME records towards to for the CA to follow.
The problem however stays the same, if the credentials get compromised
the malicious user is again able to issue certificates for all the
domains pointing CNAMEs towards the validation zone in question. This
information is also easily acquired by going through CT logs and trying
to resolve the validation subdomains for each CN and SAN domain.

The only cloud DNS service provider I know that actually allows creation
of subdomains with separate credentials is Microsoft Azure. Some
providers make it possible to create new credentials and to assign a
subdelegate zone for these credentials, and pointing the CNAME there.
These solutions are a bit better, but still largely outside of the reach
of a typical user.

To fix these issues I wrote a small piece of server software (
https://github.com/joohoi/acme-dns/ ) that can be used to fix the issues
described above, but using it in large scale would raise new questions
about trust in general and the role of the service provider in the whole
chain. After all, this software isn't designed to be deployed by every
user of DNS challenge.

Would a reasonable solution be to deploy something similar to the
ACME-DNS software closer to the CA?

--
Joona Hoikkala