Re: [Acme] acme in a firewalled environment

I would assert that it is completely in scope because we have most
experience of meeting this requirement.

It is also the only model that is going to scale long term. Right now
I have 20 services running on 5 servers in my house and I am an
outlier. It won't be long before that is a commonplace situation for
Internet of Things. The consumer use case is going to look very much
like the enterprise.

If you want encryption everywhere then you have to support a mechanism
that allows one successful validation interaction to be amortized over
multiple certificate subscriptions.

It is easy enough to do. It is simply a matter of getting the
architecture right. And that isn't too difficult since we have at
least two tried and tested proprietary schemes that can be used as
starting points (OK I don't speak for Symantec's willingness to
contribute but Comodo would certainly like to be out of the server
plug in maintenance game.

On Tue, Dec 2, 2014 at 1:01 PM, Ben Schumacher <bschumac@cisco.com> wrote:
> On 12/2/14 10:52 AM, Eliot Lear wrote:
>>
>> Question:
>>
>> Are the myriad of enterprise servers in scope for ACME?  In those
>> environments it's not unreasonable to assume that a firewall exists to
>> prevent incoming connections, and DNS control is not available.  In fact
>> split DNS might introduce all sorts of fun resolution issues even if
>> control is possible from the inside.
>
>
> Eliot-
>
> I would say it is probably out of scope, with regard to public CAs, but
> there is nothing that would prevent an enterprise-wide CA that could be ACME
> enabled.
>
> For example, ACME could be integrated into the Certificate Management
> functionality of your enterprise directory services / host management
> infrastructure.
>
> Thanks,
> Ben
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme