Subject: [Acme] ACME for pre-ACME CAs

From: Richard Barnes <[email-masked]>
Date: Tue, 22 Dec 2015 15:02:51 -0500

Hey all,

I mentioned at the IETF meeting that a major next milestone for ACME
is to get it to the point where it can be used by current CAs,
including ones that require clients to pay for certificates.  I've
been chatting with Andrew Ayer and a few other folks about how to do
this, and have come up with the following loose proposal (in a Gist
because it's a little long):

https://gist.github.com/bifurcation/8c955b99bd0daec8673d

tl;dr:
- Add an "order" resource type that can group certificates
- Reinforce the distinction between certificate requests and certificates
- Add an "activation" action or an "out-of-band" challenge type

If we can get to some agreement on the list about what the right
overall form is, we can start making some PRs in the new year.

Thanks!

--Richard

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 Dec 2015 14:57:58 +0000

Speaking not as chair,

I think an "out of band" makes a great deal of sense.  The challenge should have some opaque token that is used; perhaps the URI is enough.  And the response should be some opaque token that the server can use to verify that the challenge was completed (e.g., an opaque ref to an internal transaction-id).

--  
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz