Re: [Acme] Server on >= 1024 port

Yoav Nir <ynir.ietf@gmail.com> Wed, 02 December 2015 14:36 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\))
From: Yoav Nir <ynir.ietf@gmail.com>
In-Reply-To: <565EBF56.3070502@desy.de>
Date: Wed, 02 Dec 2015 16:36:00 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <D836A378-DA88-4AAF-B1E4-F34A80319DC1@gmail.com>
References: <565589E4.2030107@desy.de> <565EBF56.3070502@desy.de>
To: Paul Millar <paul.millar@desy.de>
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/wmyWxxEUJBaCueAJ52KZ7l6SInU>
Cc: acme@ietf.org
Subject: Re: [Acme] Server on >= 1024 port
Precedence: list

> On 2 Dec 2015, at 11:52 AM, Paul Millar <paul.millar@desy.de> wrote:
> 
> Hi all,
> 
> I'm writing just to summarise this thread and check a consensus has been reached.
> 
> On 25/11/15 11:13, Paul Millar wrote:
>> I was wondering whether people have considered services running on a
>> port other than port 443; in particular, ports greater than 1024.
> 
> The decision is not to support unprivileged ports (>= 1024) because of two factors:
> 
>  1.	ACME wishes to support deployments where there are untrusted
> 	users have (non-root) access to the same machine that
> 	provides a trusted service.
> 
>  2.	There is no supported mechanism for a CA to issue a
> 	certificate that is bound to a specific port.
> 
> Removing either of these points would allow (in principal) ACME to support issuing certificates to services running on unprivileged ports.
> 
> Is that a fair summary?

I think not. I think towards the end the discussion got to a point that we don’t think there is much difference between x>=1024 and x<1024 as long as x!=443. How particular operating systems authorize users to set up servers on different ports is not something we can make sweeping generalizations about. So I don’t think there is consensus to use any port other than 443 for validating certificates for HTTPS.

Yoav

[Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port moparisthebest
Re: [Acme] Server on >= 1024 port Roland Zink
Re: [Acme] Server on >= 1024 port Martin Thomson
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Stephen Farrell
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Paul Millar
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Yoav Nir
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Salz, Rich
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Ted Hardie
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Romain Fliedel
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Richard Barnes
Re: [Acme] Server on >= 1024 port Phillip Hallam-Baker
Re: [Acme] Server on >= 1024 port Peter Eckersley
Re: [Acme] Server on >= 1024 port James Cloos
Re: [Acme] Server on >= 1024 port Eric Rescorla
Re: [Acme] Server on >= 1024 port Niklas Keller
Re: [Acme] Server on >= 1024 port Randy Bush
Re: [Acme] Server on >= 1024 port Eric Mill
Re: [Acme] Server on >= 1024 port Darren J Moffat
Re: [Acme] Server on >= 1024 port Rob Stradling
Re: [Acme] Server on >= 1024 port Ángel González
Re: [Acme] Server on >= 1024 port Vincent Lynch