[Acme] [Errata Held for Document Update] RFC8555 (6317)

RFC Errata System <rfc-editor@rfc-editor.org> Thu, 11 January 2024 21:32 UTC

To: matt@lightcodelabs.com, rlb@ipv.sx, jsha@eff.org, cpu@letsencrypt.org, jdkasten@umich.edu
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: rdd@cert.org, iesg@ietf.org, acme@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240111213157.B24ED1A2161C@rfcpa.amsl.com>
Date: Thu, 11 Jan 2024 13:31:57 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/jufiw7-c9EOfwPos-VsGdajSBDI>
Subject: [Acme] [Errata Held for Document Update] RFC8555 (6317)
Precedence: list

The following errata report has been held for document update
for RFC8555, "Automatic Certificate Management Environment (ACME)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6317

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Matthew Holt <matt@lightcodelabs.com>
Date Reported: 2020-10-23
Held by: Roman Danyliw (IESG)

Section: 7.5.1

Original Text
-------------
The server is said to "finalize" the authorization when it has
completed one of the validations.

Corrected Text
--------------
The server is said to "finalize" the authorization when it has
successfully completed one of the validations or failed all of
them.

Notes
-----
The current handling of failed challenges is ambiguous, or at least inefficient.

To get a certificate, a client creates an Order. The client then has to validate all Authorizations ("authzs"). For each Authorization, the client needs to successfully complete one of the offered Challenges. One successful Challenge is sufficient to validate the authz. However, currently in practice, one failed Challenge is sufficient to invalidate the authz, and thus the entire Order. To try another Challenge, the client then has to first deactivate the other Authorizations (expensive) and create a new Order (also expensive), then repeat the whole process, remembering what was already tried.

It is proposed that an Authorization MUST NOT be finalized until all possible challenges have failed. The client could then simply try the next Challenge. In other words, a single failed Challenge should not invalidate an authz; an authz should be "pending" until all offered challenges have failed or one has succeeded.

The spec should be clear that a single failed challenge is not sufficient to finalize an authz which has multiple possible challenges.

ACME servers see many, many failed validations. ACME clients need to keep more state. This change will speed up ACME transactions, lower costs for CAs, reduce code complexity, and make ACME more reliable on the whole.

Real-world experience: https://github.com/mholt/acmez/commit/80adb6d5e64a3d36a56c58c66965b131ea366b8c
Mailing list discussion: https://mailarchive.ietf.org/arch/msg/acme/wIHaqikTCZ59zrWsUUus8lZ4VSg/

--------------------------------------
RFC8555 (draft-ietf-acme-acme-18)
--------------------------------------
Title : Automatic Certificate Management Environment (ACME)
Publication Date : March 2019
Author(s) : R. Barnes, J. Hoffman-Andrews, D. McCarney, J. Kasten
Category : PROPOSED STANDARD
Source : Automated Certificate Management Environment
Area : Security
Stream : IETF
Verifying Party : IESG

[Acme] [Errata Held for Document Update] RFC8555 … RFC Errata System