IETF Logo Mail Archive

Re: [Acme] Optional "Wildcard" authorization field

Richard Barnes <rlb@ipv.sx> Fri, 02 March 2018 17:29 UTC

Return-Path: <rlb@ipv.sx>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E02B12DA49 for <acme@ietfa.amsl.com>; Fri, 2 Mar 2018 09:29:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AJNNmPe_CgUG for <acme@ietfa.amsl.com>; Fri, 2 Mar 2018 09:29:04 -0800 (PST)
Received: from mail-wr0-x233.google.com (mail-wr0-x233.google.com [IPv6:2a00:1450:400c:c0c::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A083B12DA45 for <acme@ietf.org>; Fri, 2 Mar 2018 09:29:04 -0800 (PST)
Received: by mail-wr0-x233.google.com with SMTP id z12so10884565wrg.4 for <acme@ietf.org>; Fri, 02 Mar 2018 09:29:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=l9bUkWJ+Qv1cdUpd8RAezCToSJwLPRnjXqgKPSLizy8=; b=kd9MIN5Z6RH0CvOwB+nkmcDM0M0QjIxz0ytAAaHOEuo/xTYpCUMaBxVFD1AE/NzWfk etJNZdQInwncYr7WvMOZRtk2ZrvHATeq0dUM/7fTDhaueLAK1kGZN/spAXtmczQBt5KQ 8qW43cw6Ry3kI4D6csyhaGuxRxO0OYk7qR0vy9pIOZUpYlzRin3I3SdgHLaUqGP8kmvl qWAMsOAJMWv3VC/z/2iHnMCcSNeFGqJF836WKUDnypjcp8LL8FEfbnQ/+pLbRJytNe1K gdMLp/RT6SvdIK6FGKRGUR/puTYvg5ZbRAUEuDtAwSoqBDc5d3UIbCT5VP9tiuZxTz5V mftg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=l9bUkWJ+Qv1cdUpd8RAezCToSJwLPRnjXqgKPSLizy8=; b=KtOEsnLeYDv4d5MmfjmqiLiwjB5mc5nnEHjhKl1bC+4cWcL4YJEF61WSOsXBTp+6WT C1EJEm1STHmjHx7fygD3jxijsWE/P6IhvSV1CVG3w57xImyXuJgKcAGKVZ69pBb3nsDv kQLk4ai2X+ZJ9I0oYi62kGcaZM/saexvaWlKaEFCDdCKIT3YOH6iFtWvhsVMF0RSmArh ljmAMN/NJl7rJESQvM41lAth8fAOUZzsMsXBAYpNIRzt8yxJV/ZbeqfXAj+NQ/JKrUUM 8FbxrjASctghPpR0aU79ofH/2AszeUg+IcJklajlywpfT5CBttijt4AOYwuRJXHcoNOE YZKg==
X-Gm-Message-State: APf1xPA1PF/nfETUCD0OfyBam2VySHp4n9oTdsFTu+mw8XENYEcK+70l zwRaroFWvdqO1i8eWWrpKaBh9ELe8DZB+KwZeNtJTA==
X-Google-Smtp-Source: AG47ELtOK2dLj7JMkGGDerxLQwglqtfDoxiiOx2mf+m1HsuHUbNnj4ztfPH4moGOHJKmJxOX0M2YQauqm6KXMO9etrg=
X-Received: by 10.223.187.147 with SMTP id q19mr5330318wrg.150.1520011742810; Fri, 02 Mar 2018 09:29:02 -0800 (PST)
MIME-Version: 1.0
Received: by 10.28.12.140 with HTTP; Fri, 2 Mar 2018 09:29:02 -0800 (PST)
In-Reply-To: <CAKnbcLjuVPZa5P2FZa_cKAGmk1dP6ezrv3AgWSp9KK5HCzxPbg@mail.gmail.com>
References: <CAKnbcLjuVPZa5P2FZa_cKAGmk1dP6ezrv3AgWSp9KK5HCzxPbg@mail.gmail.com>
From: Richard Barnes <rlb@ipv.sx>
Date: Fri, 02 Mar 2018 12:29:02 -0500
Message-ID: <CAL02cgQwZzKXvPsWr=tAbB-bi2s-gw3+TtJwkawHoEEb=6MiFw@mail.gmail.com>
To: Daniel McCarney <cpu@letsencrypt.org>
Cc: IETF ACME <acme@ietf.org>
Content-Type: multipart/alternative; boundary="089e0820f2b8fc276e0566714f71"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/aIhS4-MCmNLed9d0pk3n8TODFV4>
Subject: Re: [Acme] Optional "Wildcard" authorization field
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Mar 2018 17:29:07 -0000

Daniel: I don't have a strong objection here, but could you elaborate what
the client is expected to do differently based on this flag?

On Fri, Mar 2, 2018 at 12:22 PM, Daniel McCarney <cpu@letsencrypt.org>
wrote:

> Hi folks,
>
> There is a slight disconnect with the current specification between
> identifiers in newOrder/newAuthz requests and identifiers in authorization
> objects. The former is allowed to include wildcard domains in the value of
> DNS type identifiers while the latter is forbidden.
>
> Let's Encrypt's implementation of ACME wildcard issuance guessed this
> might lead to confusion and introduced a non-standardized "Wildcard"
> boolean field in authorization objects. If true, then the identifier value
> in the authorization identifier is known to be the base domain
> corresponding to a wildcard identifier from the newOrder/newAuthz request.
>
> I think it would be beneficial to the entire ecosystem if this optional
> "wildcard" authz field could be standardized so I've sent a small PR:
> https://github.com/ietf-wg-acme/acme/pull/402 Both Certbot and ACME4J
> have independently bumped into this disconnect, which helps justify the
> need.
>
> - Daniel / cpu
>
>
>
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme
>
>

v2.23.0 | Report a Bug | By Email