Re: [Acme] On multiple CAs and contact-based recovery

[Ron <[e-mail]>]

On Thu, Mar 24, 2016 at 11:07:08AM -0400, Richard Barnes wrote:
> On Thu, Mar 24, 2016 at 5:42 AM, Ron <[e-mail]> wrote:
> > On Thu, Mar 24, 2016 at 04:45:06PM +1100, Martin Thomson wrote:
> >
> > > Most operating systems understand how to invoke local software in
> > > response to that and your proposed flow behaves much the same from a
> > > user perspective.
> > >
> > > That isn't *as* good as your proposal, I don't think, but it might
> > > have some usability advantages.
> >
> > The main downside I see to this, is that if I need to fully automate
> > the acme client to perform certificate renewals every few weeks,
> > then it's unlikely to be running on the same machine where I read
> > email.
> >
> 
> I think it's safe to say that any system which is designed to support
> re-validation with any frequency cannot involve email.

Right, what I meant to indicate there was that the acme client with
the key for my CA account was unlikely to be "local software" to the
email client I read mail in.  So being able to click on something in
an email to launch an acme client is of limited use, even for the
case of emergency recovery.

[though 'cannot' might be a bit strong.  Email does have the advantage
of being already resilient to temporary network disruptions, which is
something alternative methods would need to reimplement. This probably
could work quite well with email, but I'm not suggesting we go there
except for emergency out of band recovery. ;]


> However, note that ACME supports renewal of certificates without
> re-validation.

That was one of the nits I pointed out earlier which it would be
nice to fix.  In the current text, the only way to find out if a
server supports that or not is to try it and see if it fails.

Which realistically means, the only 'reliable' thing to automate
without out of band knowledge about the server, is to do a full
new-certificate transaction.

It would be nice if the server did return some indication that it
was prepared to support renewal with a simple GET request that
didn't require access to the account key.  Being able to drop that
privilege for routine renewals does seem like a useful feature if
we want to keep the validity period short.


  Ron