[Acme] http-01 and jws thumbnail
Stefan Eissing <stefan.eissing@greenbytes.de> Tue, 16 July 2019 10:55 UTC
Return-Path: <stefan.eissing@greenbytes.de>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 086EC1202B7 for <acme@ietfa.amsl.com>; Tue, 16 Jul 2019 03:55:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=greenbytes.de header.b=b+ABFUkP; dkim=pass (1024-bit key) header.d=greenbytes.de header.b=b+ABFUkP
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UHUlE3g_bOcj for <acme@ietfa.amsl.com>; Tue, 16 Jul 2019 03:55:46 -0700 (PDT)
Received: from mail.greenbytes.de (mail.greenbytes.de [217.91.35.233]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79B5F1202B6 for <acme@ietf.org>; Tue, 16 Jul 2019 03:55:33 -0700 (PDT)
Received: by mail.greenbytes.de (Postfix, from userid 117) id C1A1315A3AFC; Tue, 16 Jul 2019 12:55:31 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=greenbytes.de; s=mail; t=1563274531; bh=zwtt00fNFNH6kIgVPjzzsU21ibpg+I3XW1BkIewFIbw=; h=From:Subject:Date:To:From; b=b+ABFUkPSURu5bps1L5OLHjG40+KB0O4M7t1TIZYpqKQ491uzLXoqxpBUobYMjpEX b65BGbW83+1JKkn+AKtJHsymgZWJHLEy2BLlLH12lYjt4StY0+RXGoo1WcymCjPO/I pywmBPDSf/m8mioL/kWJcJi00MYcAnB/xaGeyvlQ=
Received: from icing.fritz.box (unknown [93.207.146.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail.greenbytes.de (Postfix) with ESMTPSA id 3D88115A341B for <acme@ietf.org>; Tue, 16 Jul 2019 12:55:31 +0200 (CEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=greenbytes.de; s=mail; t=1563274531; bh=zwtt00fNFNH6kIgVPjzzsU21ibpg+I3XW1BkIewFIbw=; h=From:Subject:Date:To:From; b=b+ABFUkPSURu5bps1L5OLHjG40+KB0O4M7t1TIZYpqKQ491uzLXoqxpBUobYMjpEX b65BGbW83+1JKkn+AKtJHsymgZWJHLEy2BLlLH12lYjt4StY0+RXGoo1WcymCjPO/I pywmBPDSf/m8mioL/kWJcJi00MYcAnB/xaGeyvlQ=
From: Stefan Eissing <stefan.eissing@greenbytes.de>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Message-Id: <41AA2F57-A9B7-4A12-9D74-432528BFEBF6@greenbytes.de>
Date: Tue, 16 Jul 2019 12:55:30 +0200
To: acme@ietf.org
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/nWNW5x3UxdzzWpSGb74svORHqSE>
Subject: [Acme] http-01 and jws thumbnail
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 16 Jul 2019 10:55:48 -0000
A user of my Apache ACME client asked about a feature where the security implications are not clear to me:
- he has several server instances that may receive the CA's http-01 challenge request. He therefore would like all servers to answer to all challenges like the solution proposed by acme.sh: <https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode>
server {
...
location ~ ^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)$ {
default_type text/plain;
return 200 "$1.6fXAG9VyG0IahirPEU2ZerUtItW2DHzDzD9wZaEKpqd";
}
which sends the thumbnail back to anyone asking. Is this an example to follow? It feels very open...
Thanks,
Stefan
- [Acme] http-01 and jws thumbnail Stefan Eissing
- Re: [Acme] http-01 and jws thumbnail Alan Doherty
- Re: [Acme] http-01 and jws thumbnail Jacob Hoffman-Andrews
- Re: [Acme] http-01 and jws thumbnail Stefan Eissing