[Acme] How automated should ACME be?

[Trevor Freeman <[e-mail]>]

To digress from the  ASN.1 woes discussion, I would like to ask some higher
level question:   

 

How automated should ACME be?

 

What are the set of automated scenarios we want ACME to support?

 

If I am managing n servers, how automated can I expect the management of
those n servers to be?

 

If I wanted to add a new type of certificate to my servers, how many places
do I need to visit to make that happen?

 

What I don't see in ACME at the preset is the management request\response
pair that would for instance exchange information to enable an ACME client
to create certificate requests e.g. what algorithm, parameters etc. 

 

ACME is establishing DV scoped RAs. Tying the authentication of the RA to a
specific form of authentication seems a little retro. We need a strong form
of authentication for the RA, but why don't we tokenize the RA
authentication to make ACME support multiple ways to authenticate? 

 

Trevor