Re: [Acme] ACME or EST?

Setting aside the technical differences for a moment, the intents of EST
and ACME are different; EST was intended to support enrollment of arbitrary
types of devices that are more-or-less already known to the CA, whereas
ACME is for provisioning the web servers of domain owners. This difference
of intent explains, for instance, why ACME supports "validation of
possession of identifiers", while EST has the notion of "authorization".

Without having read ACME in depth, I suspect EST is a bit more general.
That's not to say ACME couldn't be made more general - and certainly not to
claim that generality is necessarily good :) but it serves some cases.

On Tue, Nov 25, 2014 at 7:34 PM, Phillip Hallam-Baker <phill@hallambaker.com
> wrote:

> How about XKMS? It has much less ASN.1, its all angle brackets.
>
> Stephen F. knows about it, he was the WG chair.
>
>
> Less ASN.1 is always good.
>
>
> On Tue, Nov 25, 2014 at 4:55 PM, Richard Barnes <rlb@ipv.sx> wrote:
> > A few things off the top of my head:
> >
> > * If nothing else, much less ASN.1.  (Cf. JOSE vs. CMS)
> > * Support for other certificate management functions, e.g., revocation
> > * Validation of possession of identifiers
> > * Cleaner use of HTTP
> >
> >
> >
> > On Tue, Nov 25, 2014 at 4:41 PM, Paul Hoffman <paul.hoffman@vpnc.org>
> wrote:
> >>
> >> Greetings again. The abstract of the ACME pre-draft at
> >> https://github.com/letsencrypt/acme-spec (which Richard will hopefully
> >> publish as a real draft soon) says:
> >>
> >>    This
> >>    document describes a protocol that a certificate authority (CA) and a
> >>    applicant can use to automate the process of verification and
> >>    certificate issuance. The protocol also provides facilities for
> >>    other certificate management functions, such as certificate
> >>    revocation.
> >>
> >> This overlaps a lot with "Enrollment over Secure Transport" (EST),
> >> <https://tools.ietf.org/html/rfc7030>.
> >>
> >> For many people who saw last week's announcement, the main use case of
> >> ACME is "make it easy to create a client that can create a key, get it
> >> enrolled with a server, get the new certificate back, and install that
> >> certificate in a web server". What does/will ACME offer that EST does
> not
> >> already?
> >>
> >> --Paul Hoffman
> >> _______________________________________________
> >> Acme mailing list
> >> Acme@ietf.org
> >> https://www.ietf.org/mailman/listinfo/acme
> >
> >
> >
> > _______________________________________________
> > Acme mailing list
> > Acme@ietf.org
> > https://www.ietf.org/mailman/listinfo/acme
> >
>
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme
>

-- 
Mike Jenkins
mjjenki@tycho.ncsc.mil - if you want me to read it only at my desk
m.jenkins.364706@gmail.com - to read everywhere else
443-634-3951