IETF Logo Mail Archive

Re: [Acme] SNI extension for tls-alpn-01 challenge in draft-ietf-acme-ip-05

Ryan Sleevi <ryan-ietf@sleevi.com> Tue, 23 April 2019 21:35 UTC

Return-Path: <ryan.sleevi@gmail.com>
X-Original-To: acme@ietfa.amsl.com
Delivered-To: acme@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BFDE1203AC for <acme@ietfa.amsl.com>; Tue, 23 Apr 2019 14:35:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.647
X-Spam-Level:
X-Spam-Status: No, score=-1.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KxDqs7a-DMIx for <acme@ietfa.amsl.com>; Tue, 23 Apr 2019 14:35:39 -0700 (PDT)
Received: from mail-ed1-f49.google.com (mail-ed1-f49.google.com [209.85.208.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFBE912011F for <acme@ietf.org>; Tue, 23 Apr 2019 14:35:38 -0700 (PDT)
Received: by mail-ed1-f49.google.com with SMTP id d46so14022363eda.7 for <acme@ietf.org>; Tue, 23 Apr 2019 14:35:38 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xY+BbC7+9b8sxUNkGhmxrvC0kfwRblMx1iKyv3CiuEU=; b=aCbpRXskxJDA4z2KaR+RXgUrs2k0HzRmcoLmXHY8ggVrJ6xLcJBBwRYgJ9fGaqLDVt Yl35wnf7XwTUbD4IlqkKvO66wAW+4ETdsDDm7R6HWkqEBvS32KAhJW3k4rKtBBbMSJUh Zf7UQ/1zWO4M1rwlQ6LyvcEI+pP48sD6oehcHutsk8blTf/MoWSO5fSXemW0R9uamFqi j+f4LqRu9uaTMMzLxCR36ohOIOurKrcMNjf00d9dq76pU0ig5cnq/FzzACrJcWI6JXz8 oSesqbCqmaaLdhL0Ow9BuWJa/PDPQmilXgps9UKSyTcml1KHBo80L1zb50JVXO5cF+LK nOjQ==
X-Gm-Message-State: APjAAAWIzT5vji8RNaGkwqXvz+FWXnXsOwdQP1A/37TGioxigoZxcN5F TaG9c0HpgVNjqmb9WCHcIAGK1om6
X-Google-Smtp-Source: APXvYqyAHfmOEHrxQe7bYt5DQjaU5hwJkPmkkPzzAR7qv33K9qMyfAJv9XnG+mvhoN422XKoiOv3NQ==
X-Received: by 2002:a17:906:5ad6:: with SMTP id x22mr13667211ejs.79.1556055337309; Tue, 23 Apr 2019 14:35:37 -0700 (PDT)
Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com. [209.85.128.48]) by smtp.gmail.com with ESMTPSA id f1sm4200031edm.59.2019.04.23.14.35.36 for <acme@ietf.org> (version=TLS1_3 cipher=AEAD-AES128-GCM-SHA256 bits=128/128); Tue, 23 Apr 2019 14:35:36 -0700 (PDT)
Received: by mail-wm1-f48.google.com with SMTP id v14so1930380wmf.2 for <acme@ietf.org>; Tue, 23 Apr 2019 14:35:36 -0700 (PDT)
X-Received: by 2002:a1c:988d:: with SMTP id a135mr3886643wme.24.1556055336693; Tue, 23 Apr 2019 14:35:36 -0700 (PDT)
MIME-Version: 1.0
References: <MN2PR18MB28457CCBEF6FFE2B70E286FCC3250@MN2PR18MB2845.namprd18.prod.outlook.com> <CAErg=HGYuRc+tOBwRedx5a9tnH9iVm3bfWYhfXeiHCgcvp8gMA@mail.gmail.com> <MN2PR18MB2845DBA634A0BC648222C627C3230@MN2PR18MB2845.namprd18.prod.outlook.com> <CAErg=HG=LgqDxZ8QxVSAq2K6MsKJX36o6O7v0ojS3rsgUXuHVw@mail.gmail.com> <24216.1556044089@dooku.sandelman.ca> <CAErg=HH2NqHH-+AUAXvMWBrmhOPH=86twOkr=b=F0TduB45KSw@mail.gmail.com> <32047.1556051326@dooku.sandelman.ca> <CAErg=HHFtog0NY21BCVfQoZnWnmv9tzpmYp6Gw+gA=jdePRoEA@mail.gmail.com> <3267.1556053935@dooku.sandelman.ca>
In-Reply-To: <3267.1556053935@dooku.sandelman.ca>
From: Ryan Sleevi <ryan-ietf@sleevi.com>
Date: Tue, 23 Apr 2019 17:35:25 -0400
X-Gmail-Original-Message-ID: <CAErg=HGzw2Z6w+os4AkZpoMdtc=EdoiRnkBomL-3x=e2sTpvuw@mail.gmail.com>
Message-ID: <CAErg=HGzw2Z6w+os4AkZpoMdtc=EdoiRnkBomL-3x=e2sTpvuw@mail.gmail.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: "acme@ietf.org" <acme@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000098357d0587395d17"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/p8o50llx5dd1EPQ7xLXIJHgFJkE>
Subject: Re: [Acme] SNI extension for tls-alpn-01 challenge in draft-ietf-acme-ip-05
X-BeenThere: acme@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Automated Certificate Management Environment <acme.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/acme>, <mailto:acme-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/acme/>
List-Post: <mailto:acme@ietf.org>
List-Help: <mailto:acme-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/acme>, <mailto:acme-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Apr 2019 21:35:40 -0000

On Tue, Apr 23, 2019 at 5:18 PM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

> I ommited your great explanation of the situation.
> *I* think that certificates bound to IP addresses are useful for things
> like
> server management systems (Dell DRACs, HP iLO, IBM RSA..).  As such, there
> are no cloud issues involved.


I’m a bit confused by understanding how this bit fits into the discussion.

Is the concern that the draft-acme-ip would not work for these cases,
and/or that the choice and use of TLS-ALPN (or another identifier) would
preclude addressing these use cases?

It seems that the applicability of the protocol satisfies all of these use
cases, including internal CAs. Have I overlooked a concern with respect to
SNI and ALPN?

>

v2.23.0 | Report a Bug | By Email