Subject: [Acme] Call for adoption STAR (short-term automatically-renewed) certificates

From: "Salz, Rich" <[email-masked]>
Date: Thu, 8 Jun 2017 16:25:45 +0000

At the June 2 interim, we had consensus to adopt https://datatracker.ietf.org/doc/draft-sheffer-acme-star/ as a WG document, subject to splitting
It into two documents, the ACME extension in one, and the delegation protocol in another.  This corresponds to #1 and #2 in the abstract of the draft.

The authors have agreed to do this.  Assuming that the split document is done, are there any objections to adopting *the ACME extensions* as a WG document?  Please respond by the end of next week.  We will have a separate discussion on the other protocol.

--
Senior Architect, Akamai Technologies
Member, OpenSSL Dev Team
IM: [email-masked] Twitter: RichSalz

---

From: Russ Housley <[email-masked]>
Date: Thu, 8 Jun 2017 15:56:32 -0400

After very quickly looking at the document, I am not clear which parts will make up the ACME extensions.  I need more clarity to offer an opinion.

Russ

> On Jun 8, 2017, at 12:25 PM, Salz, Rich <[email-masked]> wrote:
> 
> At the June 2 interim, we had consensus to adopt https://datatracker.ietf.org/doc/draft-sheffer-acme-star/ <https://datatracker.ietf.org/doc/draft-sheffer-acme-star/> as a WG document, subject to splitting
> IM: [email-masked] <mailto:[email-masked]> Twitter: RichSalz
>

---

From: "Fossati, Thomas (Nokia - GB/Cambridge, UK)" <[email-masked]>
Date: Thu, 8 Jun 2017 20:58:24 +0000

Hi Russ,

On 08/06/2017, 20:56, "Acme on behalf of Russ Housley" <[email-masked] on behalf of [email-masked]> wrote:
> After very quickly looking at the document, I am not clear which
> parts will make up the ACME extensions.  I need more clarity to
> offer an opinion. 

The new scope would be the extension to ACME that allows automatic
renewal of the order, i.e., sections 3.4 and 3.5 of the current draft.

Cheers, t

> > At the June 2 interim, we had consensus to
> > adopt https://datatracker.ietf.org/doc/draft-sheffer-acme-star/ as
> > a WG document, subject to splitting it into two documents, the
> > ACME extension in one, and the delegation protocol in another. 
> > This corresponds to #1 and #2 in the abstract of the draft.
> >  
> > The authors have agreed to do this.  Assuming that the split
> > document is done, are there any objections to adopting *the ACME
> > extensions* as a WG document?  Please respond by the end of next
> > week.  We will have a separate discussion on the other protocol.
> >  
> > --

---

From: Russ Housley <[email-masked]>
Date: Fri, 9 Jun 2017 16:47:47 -0400

> renewal of the order, i.e., sections 3.4 and 3.5 of the current draft.

Thanks.  This seems like a reasonable way to extend the ACME protocol to handle Recurring Orders

After reading those two sections, I looked at the discussion of extensions in draft-ietf-acme-acme, and there could be a bit of clarity added there.  Particularly, each place that the word extension is used, it should be very clear whether the text is talking about an certificate extension, and TLS protocol extension, or an extension to the ACME protocol.  All of them come up in that document.

Russ

---

From: Richard Barnes <[email-masked]>
Date: Mon, 12 Jun 2017 16:26:52 -0400

I don't think we should adopt this until the Recurring Orders stuff has
been split out.

I'm still not convinced of the need for the other interface here, much less
the need to do it in this WG.

On Fri, Jun 9, 2017 at 4:47 PM, Russ Housley <[email-masked]> wrote:

>
> > On 08/06/2017, 20:56, "Acme on behalf of Russ Housley" <
> [email-masked] on behalf of [email-masked]> wrote:
> After reading those two sections, I looked at the discussion of extensions
> in draft-ietf-acme-acme, and there could be a bit of clarity added there.
> Particularly, each place that the word extension is used, it should be very
> clear whether the text is talking about an certificate extension, and TLS
> protocol extension, or an extension to the ACME protocol.  All of them come
> up in that document.
>
> Russ
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: "Salz, Rich" <[email-masked]>
Date: Mon, 12 Jun 2017 20:32:11 +0000

> I don't think we should adopt this until the Recurring Orders stuff has been split out.

> I'm still not convinced of the need for the other interface here, much less the need to do it in this WG.

The document will be split into the recurring-order/renewal part, and the delegation part. This will be done ASAP, but certainly by the Prague publication deadline.  On the call/interim, we had consensus to do that and accept the renewal part as a WG item. We are in the midst of confirming that here on the list now.  The existing doc will not be adopted as-is.

After discussion with the AD's, the WG will decide if it wants to adopt the other protocol; we can roll that up with any other charter changes planned for Prague.

I think it's acceptable to trust that the authors (who have agreed in public and reconfirmed) will do what's been asked.

	/r$

---

From: Melinda Shore <[email-masked]>
Date: Mon, 12 Jun 2017 12:39:05 -0800

On 6/12/17 12:32 PM, Salz, Rich wrote:
> On the call/interim, we had consensus
> to do that and accept the renewal part as a WG item. We are in the
> midst of confirming that here on the list now. 

Just a reminder that consensus is established on mailing lists,
not in meetings.  That is to say, what's currently under way is
*the* consensus call.  I think the proposal as it stands is not
very clear and personally I'd prefer to see what's in the
revised document(s) before agreeing to adoption.

Melinda

---

From: "Fossati, Thomas (Nokia - GB/Cambridge, UK)" <[email-masked]>
Date: Mon, 12 Jun 2017 21:05:47 +0000

Hi Melinda,

On 12/06/2017, 21:39, "Acme on behalf of Melinda Shore" <[email-masked] on behalf of [email-masked]> wrote:
> I think the proposal as it stands is not very clear and personally
> I'd prefer to see what's in the revised document(s) before agreeing
> to adoption.

As I said upthread in reply to a similar concern expressed by Russ
about the scope of the split draft, the new document will describe the
ACME extension already documented in [1] and [2] to:
- allow requesting the automatic renewal of an order;
- provide the endpoint from which the automatically renewed certs
  are fetched;
- cancel an existing recurring order before it reaches end-of-life.

I hope this helps clearing your doubts.

Cheers, t

[1] https://tools.ietf.org/html/draft-sheffer-acme-star-02#section-3.4
[2] https://tools.ietf.org/html/draft-sheffer-acme-star-02#section-3.5

---

From: "Fossati, Thomas (Nokia - GB/Cambridge, UK)" <[email-masked]>
Date: Tue, 13 Jun 2017 08:35:00 +0000

Hi Richard,

On 12/06/2017, 21:26, "Richard Barnes" <[email-masked]> wrote:
> I'm still not convinced of the need for the other interface here,

Despite appearances, the "other" interface is not an internal one.

The actors are separate business entities, which vary in time and
space:
 - a CDN typically has many different customers;
 - a content provider may rely on more than one CDN.

Therefore, I think there is value in defining a (very) simple protocol
to model their interaction, instead of having to reinvent the same
wheel each time a content provider wants to use a new CDN, or a CDN
must plug in to a different content provider.

The interface is trivial -- but this is not an argument for not having
an interface :-)

Cheers, t