Re: [Acme] Removing TLS-SNI-02, plans for continuation of last-call

[Ilari Liusvaara <[e-mail]>]

On Fri, Jan 12, 2018 at 12:45:55PM -0500, Daniel McCarney wrote:
> Hello folks,
> 
> As I'm sure many of you are aware by now, recent developments[0] [1] [2]
> have identified real-world server/hosting configurations that violate the
> assumptions of TLS-SNI-01 as well as its currently specified replacement,
> TLS-SNI-02.
> 
> In light of these issues and the feasibility of addressing them across the
> entire Internet it seems prudent that the ACME specification remove this
> challenge type pending the development of a better alternative
> (TLS-SNI-03?). I've submitted https://github.com/ietf-wg-acme/acme/pull/390
> to make this change.

> What are the thoughts of the other WG participants?

This removes the "tls" error. I do not think this is appropriate, as
http-01 can redirect to https://, and such validation can hit TLS
errors. I think separating TLS failures and TCP failures is useful for
debugging.

Example of TLS failure is that somewhat common misconfiguration where
port 443 is not using TLS: That is _not_ a connection error, the error
happens inside TLS. Saying it is a connection error is misleading.


Other than that, I agree that we can't block on TLS-SNI-03, or
whatever -> Punt it to future draft (work on which should start soon
after getting acme-acme through IESG).


-Ilari