[Acme] ALPN based TLS challenge

[Roland Bracewell Shoemaker <[e-mail]>]

Hey all,

After the issues with the SNI based TLS challenges were discovered there was interest from a number of parties in developing another challenge that did validation at the TLS layer. After some discussion about possibilities we’ve come up with a new challenge type based on ALPN which we believe provides the required security properties which the SNI based methods did not have.

I’ve attached the rough draft of a document which defines this new method and lays out the security considerations and design rationale for it. Given the interest in getting a new TLS method specified would the WG chairs be amenable to directly adopting this as a WG work product (assuming there is consensus on list) so that we can start work on it or is it required to be submitted as a individual draft first?

Happy to field any questions about the details. I’d also like to thank everyone who provided initial input and editorial opinions on this.

Thanks,
Roland