Re: [Acme] Server on >= 1024 port

moparisthebest <admin@moparisthebest.com> Wed, 25 November 2015 17:12 UTC

To: acme@ietf.org
References: <565589E4.2030107@desy.de>
From: moparisthebest <admin@moparisthebest.com>
Message-ID: <5655EC72.7060300@moparisthebest.com>
Date: Wed, 25 Nov 2015 12:14:26 -0500
MIME-Version: 1.0
In-Reply-To: <565589E4.2030107@desy.de>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/w37jHiQmZE0QTL7n1jFfjHmwccA>
Subject: Re: [Acme] Server on >= 1024 port
Precedence: list

Hello all,

On 11/25/2015 05:13 AM, Paul Millar wrote:
> I was wondering whether people have considered services running on
> a port other than port 443; in particular, ports greater than
> 1024.

I'm also somewhat concerned about this, I've read statements like this
when talking about port 443:

> ACME server needs some sort of assurance that the client controls
the server.

But I don't really know why that is or should be the case at all?
Certs aren't really issued to the machine, but rather to any service
on any port.  There are countless services that run over TLS, IRC
generally on 6697/7000/9999, XMPP on 5223, imaps, smtps, pops etc etc etc.

Why shouldn't the client simply be able to tell the ACME server what
port to test, and the ACME server assume if the client has access to
ANY port on the server then it should be able to host ANY TLS service
on that server?

Thanks,
moparisthebest

[Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Roland Zink
Re: [Acme] Server on >= 1024 port Martin Thomson
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Stephen Farrell
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Eric Mill
Re: [Acme] Server on >= 1024 port Darren J Moffat
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Ángel González
Re: [Acme] Server on >= 1024 port Vincent Lynch