IETF Logo Mail Archive

Re: [Acme] ACME or EST?

Nico Williams <nico@cryptonector.com> Wed, 26 November 2014 03:16 UTC

Return-Path: <nico@cryptonector.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC5301A87BA for <acme@ietfa.amsl.com>; Tue, 25 Nov 2014 19:16:50 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.666
X-Spam-Level:
X-Spam-Status: No, score=-1.666 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KMGrBayUku-c for <acme@ietfa.amsl.com>; Tue, 25 Nov 2014 19:16:50 -0800 (PST)
Received: from homiemail-a36.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) by ietfa.amsl.com (Postfix) with ESMTP id 52F581A87B0 for <acme@ietf.org>; Tue, 25 Nov 2014 19:16:50 -0800 (PST)
Received: from homiemail-a36.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTP id 2B12277805B; Tue, 25 Nov 2014 19:16:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=cryptonector.com; h=date :from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=cryptonector.com; bh=9a167N0PGO3m/Z LSWkR08qdBLXU=; b=ZjtzaoRCgA2mtbscccbY4shWHcCWArb8YkhWO6ZWr9iylt eqsyAgvkhWkxUwPVoBaEixeO+uB9RDmcEj8sg1ap5ZTFdV1ucRaHzDA567dttEkR nb7KnQTwtDj5mrXWke/g4mPZa0ylSw91gzcj5mtmi61ST7kniJkpocaQz0Mnw=
Received: from localhost (108-207-244-174.lightspeed.austtx.sbcglobal.net [108.207.244.174]) (Authenticated sender: nico@cryptonector.com) by homiemail-a36.g.dreamhost.com (Postfix) with ESMTPA id 93547778056; Tue, 25 Nov 2014 19:16:49 -0800 (PST)
Date: Tue, 25 Nov 2014 21:16:49 -0600
From: Nico Williams <nico@cryptonector.com>
To: "Salz, Rich" <rsalz@akamai.com>
Message-ID: <20141126031647.GA3200@localhost>
References: <AD5940AA-6F01-4D0E-A4E0-19AEA56BBED3@vpnc.org> <CAL02cgTgpjQffow2XuaNuT7BtqYVttXdVUgyqBFbsAbN4g0VzQ@mail.gmail.com> <CAMm+Lwje44G2CZLfYJQAAR41CBw7+SCZNwdNPy+zO-VOeHZvkw@mail.gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C71D53CC400F@USMBX1.msg.corp.akamai.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <2A0EFB9C05D0164E98F19BB0AF3708C71D53CC400F@USMBX1.msg.corp.akamai.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/acme/guJYWUZbdAl3zuCmV6BbCpl3-eQ
Cc: Richard Barnes <rlb@ipv.sx>, Phillip Hallam-Baker <phill@hallambaker.com>, Paul Hoffman <paul.hoffman@vpnc.org>, "acme@ietf.org" <acme@ietf.org>
Subject: Re: [Acme] ACME or EST?
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Nov 2014 03:16:51 -0000

On Tue, Nov 25, 2014 at 09:20:04PM -0500, Salz, Rich wrote:
> What's the new name for XML?  Legacy json?

They have very different semantics :( but I get the joke :)

> XKMS definitely has some worthy ideas to consider.  But it never got
> much traction AFAIK.

If there's anything worse than ASN.1^H^H^H^H^H BER it's got to be XML...

> SCEP, XKMS, KMIP, PKCS7/10, EST...  the nice thing about enrollment
> protocols is there are so many to choose from.

And yet deployment as a fraction of enrollment activity is not
significant for any of them.  OK, OK, I don't have numbers as to this.

> It's trendy, but maybe capturing mindshare and lowering the barrier to
> acceptance is really important for getting everyone to get a cert.

As long as it's something that CA operators decide to offer.  Or those
CA operators that do win enough market share.

Syntax and encoding are only barriers though.  If barriers are the only
problem, then by all means, otherwise you're right.

Nico
--

v2.23.0 | Report a Bug | By Email