IETF Logo Mail Archive

[Acme] Re: Potential issues with dns-persist-01

Shiloh Heurich <shiloh@heurich.com> Fri, 17 April 2026 13:49 UTC

Return-Path: <shiloh@heurich.com>
X-Original-To: acme@mail2.ietf.org
Delivered-To: acme@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id BE014DE478F3 for <acme@mail2.ietf.org>; Fri, 17 Apr 2026 06:49:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1776433795; bh=XnJZuFBITBW7jthEALZBcHzqZ7eDt4wDvyaQM4ecczM=; h=From:Subject:Date:In-Reply-To:Cc:To:References; b=tV8hGBT/m6wDhMQg0dPbD3NGKpihqQx/2gI9Qpye2X0gEC4Ux3/cKaCqKIxK2g/CJ k1CPO5P/PySsOLGOBBIDXus7w7y5j9y8CMVOeoPGhEWM7pFSNHhrB49S7yv8vLUNjV fVSpNY5IR+5/UAQySr4rMq/TDDQbrMkEDezddlqg=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=heurich.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fFva2mbnlusI for <acme@mail2.ietf.org>; Fri, 17 Apr 2026 06:49:55 -0700 (PDT)
Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 60C86DE478E9 for <acme@ietf.org>; Fri, 17 Apr 2026 06:49:55 -0700 (PDT)
Received: by mail-qk1-x72d.google.com with SMTP id af79cd13be357-8cbb6d5f780so63139785a.1 for <acme@ietf.org>; Fri, 17 Apr 2026 06:49:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heurich.com; s=google; t=1776433795; x=1777038595; darn=ietf.org; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:from:to:cc:subject:date:message-id:reply-to; bh=uLWPY1RzscyGaDFHpFUv3E4385dR58r0syO4eJkdWnA=; b=laU6U2Ica79fp5wVpvxtLifcT4kwUycRn6hmqxI/SyUgx3JdExk9p3oX2+0WjR5CjP X9Wmk7asdQV69zXnO2cw9jlEkFGJcKVxWtcQuHi4jp37hAuwFa8Zb9lZgh84osA6ZXU3 GfN742YgIWwU/x04KmKIPDNlP7kSh8/SxrBKQZv/TOzpd1a4TwfrnFYb901ycjKkIgZb TPyko2zZqcmkO+YVxTEV4uCuzVhtCNMSrOKrIx7YtyZzBiYXXxlCBNNZpJ6zOZHJZ8qN 08Wjww9fnahJZ6jwFWVO+JBmcb4hUsf5/7mz9gYvBFbgMaWWokdFh1xyaT1tZIwZ0zzE F5Pg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776433795; x=1777038595; h=references:to:cc:in-reply-to:date:subject:mime-version:message-id :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=uLWPY1RzscyGaDFHpFUv3E4385dR58r0syO4eJkdWnA=; b=Wraad6w9nayyOJII8gSIStmc1I/PvZYhqB07ABhXlWiACW9krxed0Np2GfEH7nLw6b +4xUmPXAuwkOokmqbqrVAL9ICdMxKyX9GRo3OEfdtpuBjNBG6iDoZW02FZo79f5Nw8Mo ZQBxlHn6cNc7v6qd1y4gir1TvGG4LpLHUj90ABgNzK9YT4XUcOBJSTs/VjGm62y6bm/Q 028cToAnyMJDQVd7Wn1sZJ7+HU9SLjLuYvtXKGcVpKbf0RmNw7ynkHJaK5idGZ1yTsef VeHIx2HzHOmdeq4waOgEHJqZsao565DYZ7ldTykRykrZ2hGpBa2u6In9NvhXPWvZcWyo FKbQ==
X-Gm-Message-State: AOJu0Yzye4Sn6QGPxGTUji5zj8H9YsRIUm/jNErO9azr9wemrhTs96sg 3yrJGRdJ2Zqrr6HkfPqS7M5pXX3GdR7Eq2mQ0fb/JfHxYkxrOF61qpmX4mPDZqZ7xycAxXTUuAX O55mgoPQ=
X-Gm-Gg: AeBDiesn3j02hvLj430w4wpZBc4S6fWYTW/8Vh9+R+i0mn43PvYQzGDKamiH0yoXxn7 B5NqfaYBDeMrK84SWSc5/TgR455Npl95akcFrXo1BbMdOKJx6mFkTeFZt7TbU2JzMuPnxbQhqta sIjwfJ45XeZbYS1o1iBn2NR1Zb4Rt/zu3oczCKI75AHSElewPZDSRXLurhBEOGLcNVcPEpWI+Hi EzvbLZK/3GcvedZ6k0gV1MKj5DxbEvsOsiAXrQHhWTZkdUQ7ixnP9v+aFU36n+PPRbYoLUFUyUW VyFH58lsVK/N53oHC7EVTdPH+76VU1fzrZr7bB1rxIfDqv+1RaL5yf99vXCAnXVE5z59+RmnnZ2 ARfeotCeUE96rurwG9SqCkOXneXiFyQUudo0/fh8JOstiOs5gygJwdJ5uJcKwsmBqDFh+dYfFdg kvGIMiwvVjYnasjsIUU+/AwaAWb6Hvg2FX4TVtSGAGRjylK5evBJJQ2w==
X-Received: by 2002:a05:620a:19a5:b0:8d6:7dc4:6907 with SMTP id af79cd13be357-8e792180273mr355760985a.45.1776433794763; Fri, 17 Apr 2026 06:49:54 -0700 (PDT)
Received: from smtpclient.apple ([216.245.86.140]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8e7d8edb7a1sm113712685a.30.2026.04.17.06.49.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Apr 2026 06:49:54 -0700 (PDT)
From: Shiloh Heurich <shiloh@heurich.com>
Message-Id: <7782E6C1-429C-4DDC-B41D-B7735BFB6B73@heurich.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_06132B57-ADD6-41FB-86CC-518B489747C7"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\))
Date: Fri, 17 Apr 2026 09:49:43 -0400
In-Reply-To: <8559F9FA-9984-4019-81FD-F6FBB86F2E0B@gmail.com>
To: Seo Suchan <tjtncks@gmail.com>
References: <CAFg2froJTxp+kT_VdSuNs9LVqFQhO-WJZBt=-qoVQO9c8M+=Xw@mail.gmail.com> <CAEmnErdOBBzj+5nuZBYo0zN64zMXDeX-3sdcFBQqJirmHky2gA@mail.gmail.com> <0548587B-B211-4BC9-8F4F-51F30EC555E0@heurich.com> <EDFCDF8C-28C2-42E9-8A22-0583BEF60DD9@gmail.com> <1C14DDF1-9CFD-4A57-ABF5-D186038E0896@heurich.com> <8559F9FA-9984-4019-81FD-F6FBB86F2E0B@gmail.com>
X-Mailer: Apple Mail (2.3864.500.181)
Message-ID-Hash: CIXPFU25RJZMCNF7FYL7SZCNLCG4CZCQ
X-Message-ID-Hash: CIXPFU25RJZMCNF7FYL7SZCNLCG4CZCQ
X-MailFrom: shiloh@heurich.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-acme.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: acme@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [Acme] Re: Potential issues with dns-persist-01
List-Id: Automated Certificate Management Environment <acme.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/hthPO4HgJ2j76imhLGFpIt7a72k>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Owner: <mailto:acme-owner@ietf.org>
List-Post: <mailto:acme@ietf.org>
List-Subscribe: <mailto:acme-join@ietf.org>
List-Unsubscribe: <mailto:acme-leave@ietf.org>

> On Apr 17, 2026, at 09:42, Seo Suchan <tjtncks@gmail.com> wrote:
> 
> Now sure why would allowing persist record made with old key hurts. Eve can authorize some domain they control to legit owner of account, but what that helps for her? She can't even make new order with that key because it already rotated.


Oh right, after rotation the old key can't authenticate to the ACME server, so Eve can't make orders. CA key history does address this. If the CA tracks every key an account has used, old thumbprints stay valid for the original account without opening an attack. The next question is whether CAs are willing to maintain that history, though it is simple enough.

v2.46.0 | Report a Bug | By Email | System Status