[Acme] Validation methods for alternative services and SVCB/HTTPS targets

[Jeremy Saklad <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Right now, most of ACME’s validation methods can only be used by clients with IP addresses in A/AAAA records corresponding to the identifier, as well as specific open ports. This is perfectly acceptable for most use cases right now, but it becomes problematic when managing certificates for the likes of HTTP alternative services or SVBC/HTTPS targets. Such configurations require a certificate for the original identifier, but (usually) do not share the same IP addresses.

dns-01 sidesteps this limitation, but is often less secure since it usually requires credentials for DNS zone modifications to be accessible by clients.

I don’t think it is too early to start thinking about more practical solutions, in advance of draft-ietf-dnsop-svcb-httpssvc being finalized. Perhaps a new form of TLS-ALPN method that uses an SVBC/HTTPS record instead of 443/tcp and A/AAAA records? It would need to ignore the normal precedence rules, as they would preclude lower-priority targets from getting certificates.

Jeremy Saklad
-----BEGIN PGP SIGNATURE-----

iMwEARYKAHQWIQST9JhYTT2FVNyHHwCUsC6j0LZIGwUCY1q0mlYYJ2h0dHBzOi8v
b3BlbnBncGtleS5zYWtsYWQ1LmNvbS9maW5nZXJwcmludC9GRERGQzRBNEE2N0Qw
NEVGRkVCOEU0MjQ5Q0EyMTQ5NTgzRURCRjg0JwAKCRCUsC6j0LZIG4EiAP9hYryM
5LLiPaLuGiEIB7cnB9nXFPGrry/HCi9sCwvkhwD/YRcpLTl40wXYNLDwDOxcu+Zq
/uQM9RN1jnOd6Tyqtgs=
=A00V
-----END PGP SIGNATURE-----