Re: [Acme] Issue: Allow ports other than 443

Stephen Farrell <stephen.farrell@cs.tcd.ie> Thu, 26 November 2015 11:37 UTC

To: Yoav Nir <ynir.ietf@gmail.com>
References: <5e9b22a3942d4a39981878b13e4a7752@usma1ex-dag1mb1.msg.corp.akamai.com> <0630035C-E4F6-41AA-A339-7101B448F0FA@vigilsec.com> <CABkgnnUxSwMmOR=QVE-gMvj9dHW6Tk2Z=EO7RDx6E5zVAp_SrQ@mail.gmail.com> <20151124033325.GH18430@eff.org> <56545B4C.3020406@cisco.com> <CAMm+Lwg-MktfPZ0TkRgKsTan2dzDSHuaRsrCcfF-Y-HY6aTKmw@mail.gmail.com> <5656C49E.6070701@cisco.com> <5656E66B.3000803@cs.tcd.ie> <9DCF723A-8CE9-4732-9DEA-ED7EEBA362A9@gmail.com>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url=
Message-ID: <5656EEFA.6000109@cs.tcd.ie>
Date: Thu, 26 Nov 2015 11:37:30 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <9DCF723A-8CE9-4732-9DEA-ED7EEBA362A9@gmail.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/g5LyO7QQ7oGf7uW8lZKCQT0W1zU>
Cc: Phillip Hallam-Baker <phill@hallambaker.com>, Eliot Lear <lear@cisco.com>, IETF ACME <acme@ietf.org>, Russ Housley <housley@vigilsec.com>, Peter Eckersley <pde@eff.org>, Martin Thomson <martin.thomson@gmail.com>
Subject: Re: [Acme] Issue: Allow ports other than 443
Precedence: list


On 26/11/15 11:27, Yoav Nir wrote:
> 
>> On 26 Nov 2015, at 1:00 PM, Stephen Farrell
>> <stephen.farrell@cs.tcd.ie> wrote:
>> 
>> 
>> 
>> On 26/11/15 08:36, Eliot Lear wrote:
>>> Yes.  The real issue here is that the cert contains the hostname
>>> and not the port.
>> 
>> So one could define a new always-critical certificate extension 
>> saying that the cert is only for use with some set of ports. (Or 
>> maybe someone's already defined it, I forget;-)
> 
> An extension - not that I know of, but as was mentioned in the other
> thread, there’s the URI subject alternate name. However, no current
> browsers look at this field, so the URI SAN provides no security from
> the privilege escalation. OTOH a critical extension would block *all*
> existing browsers from relying on such a certificate, with the only
> remedy being “Let’s Not Encrypt”.

True. A port-specific cert would only work with updated browsers
which I guess is a fairly fatal objection to the idea. Ah well.

S

> 
> It might be OK if the extension was added only to certificates issued
> to those who could not meet the challenge on port 443, but I still
> prefer to not go there.
> 
> Yoav
> 
> 
> _______________________________________________ Acme mailing list 
> Acme@ietf.org https://www.ietf.org/mailman/listinfo/acme
>

[Acme] Issue: Allow ports other than 443 Salz, Rich
Re: [Acme] Issue: Allow ports other than 443 Russ Housley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Douglas Calvert
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Hugo Landau
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Randy Bush
Re: [Acme] Issue: Allow ports other than 443 Kathleen Moriarty
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Niklas Keller
Re: [Acme] Issue: Allow ports other than 443 Martin Thomson
Re: [Acme] Issue: Allow ports other than 443 Peter Eckersley
Re: [Acme] Issue: Allow ports other than 443 Phillip Hallam-Baker
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Stephen Farrell
Re: [Acme] Issue: Allow ports other than 443 Rob Stradling
Re: [Acme] Issue: Allow ports other than 443 Yoav Nir
Re: [Acme] Issue: Allow ports other than 443 Darren J Moffat
Re: [Acme] Issue: Allow ports other than 443 Eliot Lear