Subject: [Acme] Authorizations and Certificates in Registrations

From: Niklas Keller <[email-masked]>
Date: Sat, 5 Dec 2015 19:10:43 +0100

Hello,

what's the reason why "authorizations" and "certificates" are optional in
registration objects? They should both not be optional IMO, because they
can be used nicely to lower the load on the CA, because clients can reuse
prior authorizations and even download lost certificates easily. This makes
also revocation easier, because you can simply list all valid certificates
for a given account key.

Regards, Niklas

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Sat, 5 Dec 2015 11:38:37 -0800

> what's the reason why "authorizations" and "certificates" are optional
in registration objects? They should both not be optional IMO, because
they can be used nicely to lower the load on the CA, because clients can
reuse prior authorizations and even download lost certificates easily.
This makes also revocation easier, because you can simply list all valid
certificates for a given account key.

This is a good question. I would support making it mandatory in the
protocol. We haven't yet implemented it in Let's Encrypt, but it's on
the roadmap and it's an important feature.

Speaking of which, I've been meaning to suggest a fix to this feature.
Right now it specifies a list to be embedded in the new-reg object. It's
likely that some registrations will have very large lists of
authorizations and/certificates, making them prohibitive to embed
directly in the registration.

Instead, I propose that there be a URL for authorizations and a URL for
certificates for each registration. These URLs would return a JSON list
of URLs for the relevant objects, and possibly a Link header with
rel=next for pagination if the number of results is above a
(server-configured) threshold. Pagination is a very common approach to
large data sets in web services.

---

From: Niklas Keller <[email-masked]>
Date: Sat, 5 Dec 2015 21:09:59 +0100

> large data sets in web services.

https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#registration-objects

It's already an URL, but paging isn't mentioned yet.

---

From: Hugo Landau <[email-masked]>
Date: Sun, 6 Dec 2015 00:36:01 +0000

On Sat, Dec 05, 2015 at 07:10:43PM +0100, Niklas Keller wrote:
>    prior authorizations and even download lost certificates easily. This
>    makes also revocation easier, because you can simply list all valid

Indeed. My own client keeps a note of obtained authorizations and
their expiration dates and certificate URLs.

What might be nice is a function to find valid authorizations and
certificates by hostname, so that clients can quickly look for
objects satisfying their requirements. Servers are likely to index this
sort of thing for rate limiting purposes anyway.