[Acme] kinds of proof (was: Re: ACME or EST?)

[Stephen Farrell <[e-mail]>]

changing subject line to the interesting bit...

On 27/11/14 21:13, Viktor Dukhovni wrote:
> I agree that the wire format (syntax) is less important than the
> feature set (semantics).  In particular, there I'd like to see some
> discussion of what kind of "proofs of control" should be acceptable
> with a lights-out DV certification authority.

Yep. Fully agree about DV. But DV isn't the only kind of
validation I'd like to be supported here.

I'd like if it were possible to extend that to include cases
where one has control over the web server, but not the DNS.

Now there are dangers in that so I'm not sure if it's really
doable, but I've controlled web servers below tcd.ie for years
(e.g. [1]), without any control over DNS, and I'd like to be
able to do better than self-signed out of the box there too.

The current spec [2] seems to allow for that via the "provision
a file on the web server" method, but the details of that
("simpleHttps" I guess?) aren't clear. I'm also not sure of
the security implications, which could be a killer (for having
key authorization depend on this mechanism alone) so I'm sure
there's work to be done there.

But I'd very much like to just update apache on my servers
and have that go get certs that work.

S.

[1] https://down.dsg.cs.tcd.ie/yesicanrichard.txt
[2]
https://github.com/letsencrypt/acme-spec/blob/master/draft-barnes-acme.md