Re: [Acme] Usage of HTTP Re: ACME or EST?

Nico Williams <nico@cryptonector.com> Tue, 25 November 2014 23:16 UTC

Date: Tue, 25 Nov 2014 17:16:14 -0600
From: Nico Williams <nico@cryptonector.com>
To: Richard Barnes <rlb@ipv.sx>
Message-ID: <20141125231612.GW3200@localhost>
References: <CAL02cgTSiugToRqMWAHqcBOVR0RGxLhjkJ-3FyPt6HP-qcV16w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <CAL02cgTSiugToRqMWAHqcBOVR0RGxLhjkJ-3FyPt6HP-qcV16w@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Archived-At: http://mailarchive.ietf.org/arch/msg/acme/x_CXkHQOnWcGAUqRFFxfSbeXnIs
Cc: "acme@ietf.org" <acme@ietf.org>, Paul Hoffman <paul.hoffman@vpnc.org>
Subject: Re: [Acme] Usage of HTTP Re: ACME or EST?
Precedence: list

On Tue, Nov 25, 2014 at 06:00:18PM -0500, Richard Barnes wrote:
> (new subject, since we're diverging from EST)
> 
> On Tue, Nov 25, 2014 at 5:37 PM, Nico Williams <nico@cryptonector.com>
> wrote:

Thanks.  You've answered my all questions.

> [...]
> The two ways to comply with that are (1) to use the same URI for
> everything, or (2) to start from a single URI and discover other URIs
> through the protocol.  Option (1) seemed simpler for this protocol.

I've a feeling that (2) is what the APPSWG folks like, but I'm fine with (1).

> > Clients could learn it via RFC5988 link relations, no?
> 
> Sure.  That would still be out-of-band w.r.t. ACME.

Er, it'd be hard to add this after the fact, but let's let fans of link
relations chime in if they care to.

> > Er, are there no requests for information?  E.g., OCSP Responses,
> > acceptable attributes (for CSRs), ...?
> 
> There are, but I had considered them outside of ACME.  For example, for
> cert renewal, you just do a GET to a URL provided by the server.

Ah!  Got it.  Thanks!

Nico
--

[Acme] Usage of HTTP Re: ACME or EST? Richard Barnes
Re: [Acme] Usage of HTTP Re: ACME or EST? Nico Williams
Re: [Acme] Usage of HTTP Re: ACME or EST? Martin Thomson