Re: [Acme] kinds of proof

[Viktor Dukhovni <[e-mail]>]

On Fri, Nov 28, 2014 at 01:57:55PM -0800, Paul Hoffman wrote:

> > Because unfortunately, Web PKI certificates are host-wide, they don't
> > specify a port.  Anyone who can run some program on a machine can
> > bind to some random port and start a web service.  Possibly port-forwarded
> > somewhere else via SSH!
> > 
> > It is far from clear to me that every "shell" user of a machine
> > should be authorized to obtain certificates for the whole machine.
> 
> And it is clear to me that they should be, if we want to see more encryption
> of traffic. I have no problem with some CAs saying "we'll issue you a cert
> only if you control port X", but I absolutely want that to be a policy of
> the CA, not of the enrollment protocol.

Paul, do you have any examples of CAs that accept any port, or are
you in part making that up?  Comodo for example, requires control
of port 80:

    https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/791/16/

(See DCV method 3).

> > The protocol is just a syntax, and indeed I am asking a question about
> > appropriate CA policy.  Perhaps some guidance to CAs implementing
> > the protocol would not be amiss.
> 
> If you want to write such a thing as a separate document whose
> target audience is CAs, that's grand. It does not belong in the
> protocol.

I have no set views of whether such a thing should or not be written,
or, if yes, where.  I think some discussion of the topic is
reasonable, and perhaps you're trying to shut that down prematurely.
If the discussion yields some hints of some kind of consensus, then
we can worry about what to record and where.

-- 
	Viktor.