Subject: [Acme] ACME -06 - notBefore/notAfter

From: Yaron Sheffer <[email-masked]>
Date: Tue, 30 May 2017 18:51:41 +0300

In the "Applying for Certificate Issuance" section: the notBefore and 
notAfter fields are not part of the CSR, and it is not clear if the 
server is allowed to change them according to its own policy. E.g. for a 
shorter period than requested.

Thanks,
     Yaron

---

From: Richard Barnes <[email-masked]>
Date: Tue, 30 May 2017 11:53:44 -0400

"""
The server MUST return an error if it cannot fulfill the request as
specified, and MUST NOT issue a certificate with contents other than those
requested.
"""

https://ietf-wg-acme.github.io/acme/#rfc.section.7.4

On Tue, May 30, 2017 at 11:51 AM, Yaron Sheffer <[email-masked]>
wrote:

> notAfter fields are not part of the CSR, and it is not clear if the server
> is allowed to change them according to its own policy. E.g. for a shorter
> period than requested.
>
> Thanks,
>     Yaron
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 30 May 2017 19:03:18 +0300

OK, that wasn't clear to me in the context. Maybe change to:

The server MUST return an error if it cannot fulfill the request as 
specified (including the CSR any other fields), and MUST NOT issue a 
certificate with contents other than those requested.

On 30/05/17 18:53, Richard Barnes wrote:
> specified, and MUST NOT issue a certificate with contents other than 
> those requested.
> """
>
> On Tue, May 30, 2017 at 11:51 AM, Yaron Sheffer <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     In the "Applying for Certificate Issuance" section: the notBefore
>     and notAfter fields are not part of the CSR, and it is not clear
>     if the server is allowed to change them according to its own
>     policy. E.g. for a shorter period than requested.
>
>     Thanks,
>         Yaron
>
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/acme>
>
>