Subject: Re: [Acme] Supporting off-line (manual) validation

From: Yaron Sheffer <[email-masked]>
Date: Tue, 28 Jul 2015 22:37:46 +0300

Many clients will want to fail if the CA decides to "go offline". I 
think logic that keeps state on the CA is too complex. Better to allow 
the client to say "if offline validation is needed, please fail the 
whole transaction".

Thanks,
	Yaron

---

From: Richard Barnes <[email-masked]>
Date: Tue, 28 Jul 2015 15:57:39 -0400

On Tue, Jul 28, 2015 at 3:37 PM, Yaron Sheffer <[email-masked]> wrote:
> Many clients will want to fail if the CA decides to "go offline". I think
> logic that keeps state on the CA is too complex. Better to allow the client
> to say "if offline validation is needed, please fail the whole transaction".

I disagree.  I would really like to make ACME as incrementally
deployable as possible.  It should be trivially possible to use the
issuance and revocation transactions without using anything else from
ACME, and if we have an "offline" challenge type, then that gives CAs
a way to migrate into the authorization flow.

--Richard

>
> Thanks,
>         Yaron
>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme