[Add] Hosting Encrypted Servers on CPEs / HTTPS for Local Domains

[Dan Wing <[e-mail]>]

ADD WG,

While working to provide TLS for encrypted DNS on CPE, Tiru Reddy's IETF119 ADD presentation made it clear ADD had bumped into a larger problem: IETF and the industry has not documented how to best get certificates onto CPE.  A few companies (McAfee, Mozilla, Cujo) have deployed a system where a unique FQDN is assigned to each CPE (e.g., to the DNS server) and the CPE requests a vendor-operated cloud service to get that certificate signed by a CA and returned to the CPE and CPE uses that CA-signed certificate for incoming TLS connections.  Such a system works but the disadvantages are needing to get millions of certificates continually signed by the CA (short-lived certificates) and continued reliance on the vendor to operate the certificate-signing service.  Experience is that an exception is necessary to overcome the CA's normal rate limit.

There are two documents that discuss such a system, its drawbacks, and also explore some other system designs:
  - Martin Thomson's "HTTPS for Local Domains" (*, below), and
  - draft-rbw-add-encrypted-dns-forwarders (**, below).

Please read them prior to Thursday's ADD meeting, as I will only spend 3-4 minutes presenting and the rest of the time will be microphone discussion.


I am hoping there are authors interested in writing a problem statement document (if consensus is existing practice is too difficult) or writing a BCP/Informational document on such a vendor-operated service (if consensus is continue existing practice).

-d


(*) Martin Thomson's "HTTPS for Local Domains", https://docs.google.com/document/d/170rFC91jqvpFrKIqG4K8Vox8AL4LeQXzfikBQXYPmzU/edit, https://tinyurl.com/https-for-local-domains

(**) "Hosting Encrypted Servers on CPEs" slide deck for IETF120 ADD meeting, https://datatracker.ietf.org/meeting/120/session/add
      "Hosting Encrypted DNS Forwarders on CPEs", https://datatracker.ietf.org/doc/draft-rbw-add-encrypted-dns-forwarders/