Re: [Acme] Server on >= 1024 port

Yoav Nir <ynir.ietf@gmail.com> Thu, 26 November 2015 11:20 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <m2lh9lko2j.wl%randy@psg.com>
Date: Thu, 26 Nov 2015 13:20:44 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <5D0426D4-683C-46DF-B44C-B3F048536236@gmail.com>
References: <565589E4.2030107@desy.de> <5655EC72.7060300@moparisthebest.com> <CABcZeBOJ6O+P3U1EJoRkKaHaJVVBtLiQwpRp5aNOa+fX-noPjQ@mail.gmail.com> <5655EFCF.9090403@moparisthebest.com> <5655FC50.7000508@zinks.de> <m2lh9lko2j.wl%randy@psg.com>
To: Randy Bush <randy@psg.com>
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/qdvfSasYZFxg-kRe6V22kT2wYs4>
Cc: acme WG <acme@ietf.org>, Roland Zink <roland@zinks.de>
Subject: Re: [Acme] Server on >= 1024 port
Precedence: list

> On 26 Nov 2015, at 1:16 PM, Randy Bush <randy@psg.com> wrote:
> 
>> The resolution of a certificate is the domain name, e.g. it is valid for 
>> all services on the machine.
> 
>        X509v3 extensions:
>            X509v3 Key Usage: critical
>                Digital Signature, Key Encipherment
>            X509v3 Extended Key Usage: 
>                TLS Web Server Authentication, TLS Web Client Authentication
>            X509v3 Basic Constraints: critical
>                CA:FALSE
> 
> from a soon very popular ca

The other CAs do the same. Notice how it says “Web server authentication”, not “port 443 server authentication”.  Another thing is that I don’t get why some CAs have the web *client* authentication EKU thrown in there.  Either way, that certificate is just as good for port 5000 (python flask’s default port) as it is for port 443, and vice versa.

Yoav

[Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Roland Zink
Re: [Acme] Server on >= 1024 port Martin Thomson
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Stephen Farrell
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Eric Mill
Re: [Acme] Server on >= 1024 port Darren J Moffat
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Ángel González
Re: [Acme] Server on >= 1024 port Vincent Lynch