[Acme] [Technical Errata Reported] RFC8555 (7826)

RFC Errata System <rfc-editor@rfc-editor.org> Wed, 28 February 2024 20:25 UTC

To: rlb@ipv.sx, jsha@eff.org, cpu@letsencrypt.org, jdkasten@umich.edu, rdd@cert.org, paul.wouters@aiven.io, debcooley1@gmail.com, ynir.ietf@gmail.com
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: rob@sectigo.com, acme@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240228202520.0589A1F57D8E@rfcpa.amsl.com>
Date: Wed, 28 Feb 2024 12:25:20 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/WrnrbYJaUJL3fx9kha6SiW3SP5o>
Subject: [Acme] [Technical Errata Reported] RFC8555 (7826)
Precedence: list

The following errata report has been submitted for RFC8555,
"Automatic Certificate Management Environment (ACME)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid7826

--------------------------------------
Type: Technical
Reported by: Rob Stradling <rob@sectigo.com>

Section: 8.2

Original Text
-------------
The server MUST provide information about its retry state to the client via the "error" field in the challenge and the Retry-After HTTP header field in response to requests to the challenge resource.

Corrected Text
--------------
In responding to requests to the challenge resource while the status of the challenge remains "processing", the server MUST provide information about its retry state to the client via the "error" field in the challenge and the Retry-After HTTP header field.

Notes
-----
The current text seems to require the server to include the "error" field and Retry-After HTTP header in all responses to requests for a challenge resource, even before that challenge has moved from "pending" to "processing", and even after that challenge has moved from "processing" to "valid" or "invalid". However, the "State Transitions for Challenge Objects" diagram in Section 7.1.6 shows that it only makes sense for the server to communicate "its retry state" to the client when the challenge is "processing".

I've modelled the structure of my suggested Corrected Text on similar language in Section 7.5.1: "In responding to poll requests while the validation is still in progress, the server MUST...".

Instructions:
-------------
This erratum is currently posted as "Reported". (If it is spam, it
will be removed shortly by the RFC Production Center.) Please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party
will log in to change the status and edit the report, if necessary.

--------------------------------------
RFC8555 (draft-ietf-acme-acme-18)
--------------------------------------
Title : Automatic Certificate Management Environment (ACME)
Publication Date : March 2019
Author(s) : R. Barnes, J. Hoffman-Andrews, D. McCarney, J. Kasten
Category : PROPOSED STANDARD
Source : Automated Certificate Management Environment
Area : Security
Stream : IETF
Verifying Party : IESG

[Acme] [Technical Errata Reported] RFC8555 (7826) RFC Errata System