Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt
Q Misell <q@as207960.net> Wed, 12 July 2023 17:05 UTC
Return-Path: <q@as207960.net>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4944C15199E for <acme@ietfa.amsl.com>; Wed, 12 Jul 2023 10:05:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.995
X-Spam-Level:
X-Spam-Status: No, score=-1.995 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=as207960.net
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id refQs2XrJEMW for <acme@ietfa.amsl.com>; Wed, 12 Jul 2023 10:05:03 -0700 (PDT)
Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FCDAC1519B4 for <acme@ietf.org>; Wed, 12 Jul 2023 10:05:02 -0700 (PDT)
Received: by mail-ed1-x52d.google.com with SMTP id 4fb4d7f45d1cf-51e5e4c6026so4032849a12.0 for <acme@ietf.org>; Wed, 12 Jul 2023 10:05:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=as207960.net; s=google; t=1689181501; x=1691773501; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=tUfiCb4Bdg7AyTw2ohqTOS8T9y/e1apvM5GowpcUJZI=; b=kCyWQh1mJ9gXsGvTC0C2pctVZ+bu3omZ9nePg8y3NTsGb7oANKbMdma+i+XMoyLvzP vS7n/Vw7VGaMAZtF7ooODzE2Ilzg4h/fUAdNw+iiIPgNQdPzA1n6DELEL0xF535IK6q4 mMj7GsOTopqr/56OEqezwKVWpRT9X++juiKoKAGhWEYNzoAfPie7B5YaK4TPuCM9w8QH tpwLIaF8ceR6tqERHEFguL48N8ct3nW30p67xhDdSUv259UhkeSCTZeAwU7ibMvQvVhj xAAxJ6RJlckYtqiCoqmZpK7g/vwDCrNd+nFuWFuWyo5RMQgaj6pH6OnyOHnyKIq9Uq1p 8fGA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1689181501; x=1691773501; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=tUfiCb4Bdg7AyTw2ohqTOS8T9y/e1apvM5GowpcUJZI=; b=WJuSJQf47Pa3B571902J4lSng/AnPp0cDFR2pag0IolZ28Eb2dtOXYLJJMEZFpHUUO YCQ5mtD3d7IjSUxONaBGxG5N18NieyTeiFHko2fFhsGbfp8y9UAHDDVkr94jBsGMa58O bnRpHw/c5NXycSy28exJqDBQEc9pBurLHo63sgTku306FfPZ49osroS4Vln1ROnClRE9 4Cvy2nIJjOhG5CcvqYXF9G4kq6uNHGDOwnWfGmP+AcHrtpT7Xr/9fRMN2AImtk5aXAiX D/MGW85iJo+VQB4wif9FhzYDHVqqij578PitQ2hqHv3Yika14u/4V2lg480j+/WlDgmZ EVoA==
X-Gm-Message-State: ABy/qLZyPYDqvMVacjORqMs7lqRu2lBD27Hesp9WSQpBjCBvRTYYmfQS R5BUDM270Y5IIJpEM4UOEsa/HScVkd6bMbPq1qFVsbAPsKoFA7k81+32pg==
X-Google-Smtp-Source: APBJJlHxmo4+KUUV3uOZHsLhfSPlg9t7fmd/EUJL1SsZD+9Dic42o/VwNjn8x2z2/G+MZy11KLQtabk5vGG0wl7k++s=
X-Received: by 2002:aa7:cd5a:0:b0:51d:8a68:ed33 with SMTP id v26-20020aa7cd5a000000b0051d8a68ed33mr18700943edw.30.1689181500712; Wed, 12 Jul 2023 10:05:00 -0700 (PDT)
MIME-Version: 1.0
References: <168865435873.61106.2850041921157081937@ietfa.amsl.com> <CH0PR11MB5739FDB26BF675925C449AA69F2CA@CH0PR11MB5739.namprd11.prod.outlook.com> <c940e1f9-8dde-f116-fa7b-d7519c1b3cc7@gmail.com> <LV2PR11MB5975448E7C35FC1335F8B474F82DA@LV2PR11MB5975.namprd11.prod.outlook.com> <6628ae69-f61b-3165-3efa-7d4768e19b62@gmail.com> <D07CAC42-135C-42DA-A9A2-422B7757B448@akamai.com> <CAMEWqGskfMfcttcUTLG-3uLSQNnc+iYcWZuypCZHiETewEsG=g@mail.gmail.com> <LV2PR11MB59757256A049E053B1182D1DF836A@LV2PR11MB5975.namprd11.prod.outlook.com> <SN7PR14MB64926F791C50EDDFCF4291328336A@SN7PR14MB6492.namprd14.prod.outlook.com> <LV2PR11MB597509EC0A2577344EA0A503F836A@LV2PR11MB5975.namprd11.prod.outlook.com>
In-Reply-To: <LV2PR11MB597509EC0A2577344EA0A503F836A@LV2PR11MB5975.namprd11.prod.outlook.com>
From: Q Misell <q@as207960.net>
Date: Wed, 12 Jul 2023 18:04:24 +0100
Message-ID: <CAMEWqGv2doFwCo7F=B4HdWgw0jOBTYujLfW5z3x1iJzQvqD8ww@mail.gmail.com>
To: Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>
Cc: Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.ietf.org>, "acme@ietf.org" <acme@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000004fd6a506004d37a7"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/ngLd6PNliGz5A1syA_aFrQWOWss>
Subject: Re: [Acme] FW: [EXTERNAL] New Version Notification for draft-vanbrouwershaven-acme-auto-discovery-00.txt
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Jul 2023 17:05:07 -0000
> For a backup mechanism to work, you don't want to fail if one of your 3 records contains an error. I agree with Paul on this point. ------------------------------ Any statements contained in this email are personal to the author and are not necessarily the statements of the company unless specifically stated. AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace, Caerdydd, Cymru, CF23 9EU, trading as Glauca Digital, is a company registered in Wales under № 12417574 <https://find-and-update.company-information.service.gov.uk/company/12417574>, LEI 875500FXNCJPAPF3PD10. ICO register №: ZA782876 <https://ico.org.uk/ESDWebPages/Entry/ZA782876>. UK VAT №: GB378323867. EU VAT №: EU372013983. Turkish VAT №: 0861333524. South Korean VAT №: 522-80-03080. AS207960 Ewrop OÜ, having a registered office at Lääne-Viru maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, trading as Glauca Digital, is a company registered in Estonia under № 16755226. Estonian VAT №: EE102625532. Glauca Digital and the Glauca logo are registered trademarks in the UK, under № UK00003718474 and № UK00003718468, respectively. On Wed, 12 Jul 2023 at 17:58, Paul van Brouwershaven < Paul.vanBrouwershaven@entrust.com> wrote: > > *Tim Hollebeek* Wednesday, 12 July, 18:43 > Also, ignoring failures in CAA records is probably not the right answer. > CAA should fail closed, not open. > > For a backup mechanism to work, you don't want to fail if one of your 3 > records contains an error. You want to ignore that record only and use the > valid ones. > > > > ------------------------------ > *From:* Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.ietf.org> > *Sent:* Wednesday, July 12, 2023 6:43:21 PM > *To:* Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; Q > Misell <q@as207960.net> > *Cc:* acme@ietf.org <acme@ietf.org> > *Subject:* RE: [Acme] FW: [EXTERNAL] New Version Notification for > draft-vanbrouwershaven-acme-auto-discovery-00.txt > > > Anyone who argues that zero is a positive integer should be referred to > the standard math textbook of positive. Zero is a non-negative integer, > but I’m not aware of any definition of “positive” that makes it a positive > integer. > > > > Also, ignoring failures in CAA records is probably not the right answer. > CAA should fail closed, not open. > > > > -Tim > > > > *From:* Acme <acme-bounces@ietf.org> *On Behalf Of * Paul van > Brouwershaven > *Sent:* Wednesday, July 12, 2023 9:52 AM > *To:* Q Misell <q@as207960.net> > *Cc:* acme@ietf.org > *Subject:* Re: [Acme] FW: [EXTERNAL] New Version Notification for > draft-vanbrouwershaven-acme-auto-discovery-00.txt > > > > Hi Q, > > > > Thanks, this is great and really helpful! > > Is priority=0 an error coditition, some might argue 0 is a positive > integer? > > Any suggestion? maybe we should simply start counting at 0 instead of 1 > > What about discovery=foobar? > > "foobar" is not a Boolean, the text is clear that this parameter MUST be > a Boolean, so this should invalidate the parameter. > > Should the client ignore invalid issue records and process the rest, or > fail outright? > > We should ignore the failure of a single CAA record and continue with the > next, similar to when the client encounters ACME errors. > > > > I will clarify this with the following change: > > > > *The ACME client analyzes the CAA records - > The ACME client analyzes the > valid CAA records * > > > > It looks like you implemented discovery as a pre-condition while 3.1.1 > specifies: > > > > *When this parameter is not specified the client MUST assume that > discovery is enabled.* > > > > There is however a comment in the examples that this behavior might need > to change if deemed necessary. > > > > Paul > > > > > ------------------------------ > > *From:* Q Misell <q@as207960.net> > *Sent:* Wednesday, July 12, 2023 15:06 > *To:* Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com> > *Cc:* acme@ietf.org <acme@ietf.org> > *Subject:* Re: [Acme] FW: [EXTERNAL] New Version Notification for > draft-vanbrouwershaven-acme-auto-discovery-00.txt > > > > Hi all, > > > > I happened to be poking around the certbot codebase today and decided to > try and implement this draft. > > It turned out to be a much simpler task than I had expected, however I > felt the draft was a bit lacking in details for what the ACME client should > consider an error. > > > > For example: > > - Is priority=0 an error coditition, some might argue 0 is a positive > integer? > - What about discovery=foobar? > - Should the client ignore invalid issue records and process the rest, > or fail outright? > > My fork of certbot with the implementation is available at > https://github.com/as207960/certbot/tree/auto-discovery > <https://urldefense.com/v3/__https:/github.com/as207960/certbot/tree/auto-discovery__;!!FJ-Y8qCqXTj2!cZZsOZ0v5-kwi0u2XFbPWT2ddKQUeoKDOKjmTA0uStA0dZuwoAFoA5bphSBDyICkcF08SK8ddsv-a3_g84d3UvJ3$> > . > > > > Thanks, > > Q > ------------------------------ > > Any statements contained in this email are personal to the author and are > not necessarily the statements of the company unless specifically stated. > AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace, > Caerdydd, Cymru, CF23 9EU, trading as Glauca Digital, is a company > registered in Wales under № 12417574 > <https://urldefense.com/v3/__https:/find-and-update.company-information.service.gov.uk/company/12417574__;!!FJ-Y8qCqXTj2!cZZsOZ0v5-kwi0u2XFbPWT2ddKQUeoKDOKjmTA0uStA0dZuwoAFoA5bphSBDyICkcF08SK8ddsv-a3_g8-o0EXCj$>, > LEI 875500FXNCJPAPF3PD10. ICO register №: ZA782876 > <https://urldefense.com/v3/__https:/ico.org.uk/ESDWebPages/Entry/ZA782876__;!!FJ-Y8qCqXTj2!cZZsOZ0v5-kwi0u2XFbPWT2ddKQUeoKDOKjmTA0uStA0dZuwoAFoA5bphSBDyICkcF08SK8ddsv-a3_g86EYmrmH$>. > UK VAT №: GB378323867. EU VAT №: EU372013983. Turkish VAT №: 0861333524. > South Korean VAT №: 522-80-03080. AS207960 Ewrop OÜ, having a registered > office at Lääne-Viru maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, > trading as Glauca Digital, is a company registered in Estonia under № > 16755226. Estonian VAT №: EE102625532. Glauca Digital and the Glauca logo > are registered trademarks in the UK, under № UK00003718474 and № > UK00003718468, respectively. > > > > > > On Fri, 7 Jul 2023 at 14:32, Salz, Rich <rsalz=40akamai.com@dmarc.ietf.org> > wrote: > > > > - how about ratelimit? for large hosting they will hit CA's default > API ratelimit fast > > > > The HTTPAPI working group is working on standard HTTP headers for > specifying rate limits. See > > > https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/ > <https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/__;!!FJ-Y8qCqXTj2!cZZsOZ0v5-kwi0u2XFbPWT2ddKQUeoKDOKjmTA0uStA0dZuwoAFoA5bphSBDyICkcF08SK8ddsv-a3_g81_OWtQS$> > > _______________________________________________ > Acme mailing list > Acme@ietf.org > https://www.ietf.org/mailman/listinfo/acme > <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/acme__;!!FJ-Y8qCqXTj2!cZZsOZ0v5-kwi0u2XFbPWT2ddKQUeoKDOKjmTA0uStA0dZuwoAFoA5bphSBDyICkcF08SK8ddsv-a3_g8yXgZATe$> > > *Any email and files/attachments transmitted with it are intended solely > for the use of the individual or entity to whom they are addressed. If this > message has been sent to you in error, you must not copy, distribute or > disclose of the information it contains. Please notify Entrust immediately > and delete the message from your system.* >
- [Acme] FW: [EXTERNAL] New Version Notification fo… Mike Ounsworth
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Richard Barnes
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Fraser Tweedale
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Fraser Tweedale
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Mike Ounsworth
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Seo Suchan
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Amir Omidi
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Fraser Tweedale
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Seo Suchan
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Salz, Rich
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Salz, Rich
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Carl Wallace
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Carl Wallace
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Tim Hollebeek
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Amir Omidi
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Tim Hollebeek
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Tim Hollebeek
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Seo Suchan
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Salz, Rich
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Carl Wallace
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Tim Hollebeek
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] [EXTERNAL] New Version Notification fo… Tim Hollebeek
- Re: [Acme] [EXTERNAL] New Version Notification fo… Tim Hollebeek
- Re: [Acme] [EXTERNAL] New Version Notification fo… Paul van Brouwershaven
- Re: [Acme] [EXTERNAL] New Version Notification fo… Seo Suchan
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] [EXTERNAL] New Version Notification fo… Paul van Brouwershaven
- Re: [Acme] [EXTERNAL] New Version Notification fo… Tim Hollebeek
- Re: [Acme] [EXTERNAL] New Version Notification fo… Tim Hollebeek
- Re: [Acme] [EXTERNAL] New Version Notification fo… Paul van Brouwershaven
- [Acme] FW: [EXTERNAL] New Version Notification fo… Mike Ounsworth
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Mike Ounsworth
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Deb Cooley
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Mike Ounsworth
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Amir Omidi
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Michael Richardson
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Aaron Gable
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Paul van Brouwershaven
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Q Misell
- Re: [Acme] FW: [EXTERNAL] New Version Notificatio… Mike Ounsworth