IETF Logo Mail Archive

Re: [Acme] Issue: Allow ports other than 443

Eliot Lear <lear@cisco.com> Thu, 26 November 2015 12:30 UTC

Return-Path: <lear@cisco.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 224531A1A82 for <acme@ietfa.amsl.com>; Thu, 26 Nov 2015 04:30:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.086
X-Spam-Level:
X-Spam-Status: No, score=-15.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.585, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6QwNLSehqR1l for <acme@ietfa.amsl.com>; Thu, 26 Nov 2015 04:30:11 -0800 (PST)
Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56BA61A1A7D for <acme@ietf.org>; Thu, 26 Nov 2015 04:30:11 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2224; q=dns/txt; s=iport; t=1448541011; x=1449750611; h=subject:to:references:cc:from:message-id:date: mime-version:in-reply-to; bh=iejFRq2FeVSAAMQZg0tLwcbwuYOxaOAn0nnxg08gas8=; b=iK/UVQDwOREgNkpymcP1C2gRUNRVsgUt20Em43hizaaf2orY60aCmg4S BAQeN47EjUyu8b8l6acnC3uZzrMtU6K/Ju/5EV+biNV8ntcHmPum3rYvA Poy09XeOIfEXAw6iNycdZKUd0s7OVCHyysclykn4La9ISUB7L6ABrxsWs Y=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0CoBACw+lZW/xbLJq1ehH2/d4YPAoICAQEBAQEBgQuENQEBBCNWEAsOCgkhAgIPAkYGAQwGAgEBG4gPrgSQNQEBAQEBAQEBAQEBAQEBAQEBAQEBEAmLUoRCgzOBRAWWV4JcgWKId4kgkz5jggyBeT00hBglgSMBAQE
X-IronPort-AV: E=Sophos;i="5.20,347,1444694400"; d="asc'?scan'208";a="606816070"
Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Nov 2015 12:30:09 +0000
Received: from [10.61.166.187] ([10.61.166.187]) by aer-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id tAQCU8Gq024502; Thu, 26 Nov 2015 12:30:09 GMT
To: Yoav Nir <ynir.ietf@gmail.com>, Rob Stradling <rob.stradling@comodo.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org> <56545B4C.3020406@cisco.com> <CAMm+Lwg-MktfPZ0TkRgKsTan2dzDSHuaRsrCcfF-Y-HY6aTKmw@mail.gmail.com> <5656C49E.6070701@cisco.com> <5656E66B.3000803@cs.tcd.ie> <9DCF723A-8CE9-4732-9DEA-ED7EEBA362A9@gmail.com> <5656EEFA.6000109@cs.tcd.ie> <5656F075.1070704@comodo.com> <4BD49C12-4C5C-47D0-AA7A-68A402A0EA0F@gmail.com>
From: Eliot Lear <lear@cisco.com>
Message-ID: <5656FB4F.809@cisco.com>
Date: Thu, 26 Nov 2015 13:30:07 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <4BD49C12-4C5C-47D0-AA7A-68A402A0EA0F@gmail.com>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="td5236dARFdh2kuv6IwpkXiGPmswIxVr9"
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/bnC5ADI7b0a12lQCIJuaKpooUlU>
Cc: Peter Eckersley <pde@eff.org>, IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>, Phillip Hallam-Baker <phill@hallambaker.com>, Martin Thomson <martin.thomson@gmail.com>, Stephen Farrell <stephen.farrell@cs.tcd.ie>
Subject: Re: [Acme] Issue: Allow ports other than 443
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Nov 2015 12:30:13 -0000

Hi,

On 11/26/15 12:50 PM, Yoav Nir wrote:
>> On 26 Nov 2015, at 1:43 PM, Rob Stradling <rob.stradling@comodo.com> wrote:
>>
>> On 26/11/15 11:37, Stephen Farrell wrote:
>> <snip>
>>> True. A port-specific cert would only work with updated browsers
>>> which I guess is a fairly fatal objection to the idea. Ah well.
>> Is it worth considering requiring proof of control of (some particular combination of) _multiple_ ports rather than just a single port?  Would that strengthen the validation in any meaningful way?
> Not really. I have user access (with shell) to the a bunch of Linux servers where I work. I can run programs and open any high port I want, but I can’t open ports below 1024. 
>
> Running some script to run a web server on a bunch of high ports is trivial in a case like that. Of course “proper” environments won’t let anyone other than an administrator get shell access to a computer running a public-facing web server, but we can’t rely on all environments being properly run.
>

I'd go further: requiring proof on multiple different ports requires
more code complexity and more network complexity wrt firewalls.  That
sounds like more trouble than it is worth for a DV cert.

Eliot

v2.23.0 | Report a Bug | By Email