Subject: [Acme] Support for domains with redundant but not immediately synchronized servers

From: Jonas Wielicki <[email-masked]>
Date: Mon, 30 Nov 2015 18:17:21 +0100

Hi list,

I have asked this in the IRC and was pointed to this mailing list. I
tried to get a certificate for klausurschokola.de via Let’s Encrypt
during the currently running limited beta (we have the domain
whitelisted). The name has the following address records:

1800 	IN 	A	176.9.101.187
1800 	IN 	A 	217.115.12.71

(in addition, there is one AAAA record for each of the machines
addressed by the A records)

As you can see, two different machines are addressed. Those are
physically separated machines with different main administrators.
Both are pulling their web content from the same source, but it is not
supposed to be dynamic, so there is no "fast" (order of seconds) way
to mirror the content.

Our wish would be to be able to use different private keys and
certificates for both hosts, and renew these independently from the
other host. We thought that this would be possible using Let’s Encrypt.

The problem is that currently, the Let’s Encrypt server sometimes
chooses the wrong of the two IPs to ask for the file in
/.well-known/acme-challenge. Ideally, it would use the IP of the
requester (of course only after it has verified that the IP is in the
DNS) or allow the requester to specify a preferred IP.

For example, on 176.9.101.187:

# letsencrypt certonly -c ~/schoko.ini -d klausurschokola.de -d
www.klausurschokola.de

[… curses …]

Failed authorization procedure. klausurschokola.de (http-01):
unauthorized :: The client lacks sufficient authorization :: Invalid
response from
http://klausurschokola.de/.well-known/acme-challenge/c5HJrtp8t8JhfNgTXVC
8N7OsCrguAWGw-JTIJxCFeIQ
[217.115.12.71]: 404

Is such a thing planned? Are there security reasons against doing
this? Are there security reasons against doing this on a DNSSEC signed
domain (which klausurschokola.de is)?

best regards,
Jonas

---

From: Hugo Landau <[email-masked]>
Date: Tue, 1 Dec 2015 01:36:38 +0000

> domain (which klausurschokola.de is)?

Personally, I wouldn't think it unreasonable to allow an ACME client to
request that a specific IP be used for the purposes of a challenge. The
server would then verify that that IP is one of the candidate IPs,
rather than selecting one at random. I don't see that this causes any
loss of security, so it seems like a sensible inclusion.