[Acme] [Errata Held for Document Update] RFC8555 (6030)

RFC Errata System <rfc-editor@rfc-editor.org> Fri, 22 March 2024 15:00 UTC

To: mp+ietf@hezmatt.org, rlb@ipv.sx, jsha@eff.org, cpu@letsencrypt.org, jdkasten@umich.edu
From: RFC Errata System <rfc-editor@rfc-editor.org>
Cc: debcooley1@gmail.com, iesg@ietf.org, acme@ietf.org, rfc-editor@rfc-editor.org
Content-Type: text/plain; charset="UTF-8"
Message-Id: <20240322150045.39F495BDCA6@rfcpa.amsl.com>
Date: Fri, 22 Mar 2024 08:00:45 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/x-Yd10-42Bz25Jprgzoe2PQhEOU>
Subject: [Acme] [Errata Held for Document Update] RFC8555 (6030)
Precedence: list

The following errata report has been held for document update
for RFC8555, "Automatic Certificate Management Environment (ACME)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6030

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Matt Palmer <mp+ietf@hezmatt.org>
Date Reported: 2020-03-25
Held by: Deb Cooley (IESG)

Section: 7.2

Original Text
-------------
To get a fresh nonce, the client sends a HEAD request to the newNonce
resource on the server. The server's response MUST include a Replay-
Nonce header field containing a fresh nonce and SHOULD have status
code 200 (OK). The server MUST also respond to GET requests for this
resource, returning an empty body (while still providing a Replay-
Nonce header) with a status code of 204 (No Content).

Corrected Text
--------------
To get a fresh nonce, the client sends a HEAD request to the newNonce
resource on the server. The server's response MUST include a Replay-
Nonce header field containing a fresh nonce and SHOULD have status
code 204 (No Content). The server MUST also respond to GET requests for this
resource, returning an empty body (while still providing a Replay-
Nonce header) with a status code of 204 (No Content).

Notes
-----
RFC7321 s4.3.2, says "The server SHOULD send the same header fields in response to a HEAD request as it would have sent if the request had been a GET". I can't see any rationale for violating this SHOULD in the discussion in the GH issue which introduced the discrepancy in response code between GET and HEAD (https://github.com/ietf-wg-acme/acme/pull/371), thus (IMHO) it violates the tenets of a SHOULD, as "the full implications" do not appear to have "be[en] understood and carefully weighed before choosing a different course" (RFC2119, of course).

--------------------------------------
RFC8555 (draft-ietf-acme-acme-18)
--------------------------------------
Title : Automatic Certificate Management Environment (ACME)
Publication Date : March 2019
Author(s) : R. Barnes, J. Hoffman-Andrews, D. McCarney, J. Kasten
Category : PROPOSED STANDARD
Source : Automated Certificate Management Environment
Stream : IETF
Verifying Party : IESG

[Acme] [Errata Held for Document Update] RFC8555 … RFC Errata System