Subject: [Acme] draft minutes from june 2 interim

From: "Salz, Rich" <[email-masked]>
Date: Fri, 2 Jun 2017 19:36:13 +0000

There were about 20 people present on the call.  It lasted about 50 minutes.  Would those who were on the call please post corrections here?  Thank you.

>                Hugo's CAA draft (already adopted, short, might be ready for WGLC) -- https://tools.ietf.org/html/draft-ietf-acme-caa-01

Chairs will call for consensus on moving to WGLC.

>                Yaron Sheffer et al draft on STAR -- https://tools.ietf.org/html/draft-sheffer-acme-star-lurk-00

There was discussion on how this overlaps with the tls-subcert document. After some discussion, there was good consensus to ask that this be split into two parts (the ACME-related revalidation and the CDN-related deployment) and the chairs will ask for consensus on adoption.  The split will happen before or after adoption.

>                Mary Barnes on an ACME challenge for ATIS/SIP -- https://tools.ietf.org/html/draft-barnes-acme-service-provider-00

There was some discussion, but strong consensus to adopt this by the WG.  Chairs will confirm on the list.

>               And also Jon Peterson et al https://tools.ietf.org/html/draft-peterson-acme-telephone-00

Also similar discussion.  General agreement to also adopt this, and keep in close contact with STIR to make sure things progress properly.
 
>                Roland Shoemaker on an ACME challenge for validating IP addresses -- https://tools.ietf.org/html/draft-shoemaker-acme-ip-00

Briefly discussed; Yaron requested clarification on the use-case before considering adoption.

> In addition, Alexey is interested in helping with an ACME challenge for email certificates. Is anyone else interested in helping to draft drafting?

Alex posted a draft just before the meeting.  Consensus was to split the SMTP-server related part and the user S/MIME related part and work on them separately.

At the end of the meeting, Kathleen pointed out that Ted has a new role as IAB Chair, and wants to step down from ACME co-chair. The plan would be to have a new co-chair for Prague, and then after the Prague meeting, for Ted to abandonXXXXXX relinquish the co-chair role.  If you are interested in volunteering, please let Kathleen (and perhaps ekr and the current chairs) know.

Related to this, the ACME base document is almost done. The Chairs strongly encouraged Richard et al to finish by mid-June so that we could enter WGLC and address any issues that might come up (if any do) at the Prague meeting.

Please send/post any corrections by mid-next-week so that we can start the calls for adoption right away.

---

From: Yoav Nir <[email-masked]>
Date: Fri, 2 Jun 2017 23:12:15 +0300

Slight correction

> Alex posted a draft just before the meeting.  Consensus was to split the SMTP-server related part and the user S/MIME related part and work on them separately.

The first part is any MTA certificate. It obviously applies to SMTP servers but also IMAP servers (where they are not co-located with SMTP), and I suppose also POP3 although the draft doesn’t mention that.

The reasoning is that MTAs typically have certificates now (although many use self-issued) and they have DNS records, so automating the certificate issuance is clear and straight-forward.

Mail users don’t have any central registry ([1]) and in practice most users don’t have certificates so it’s not clear we can solve this even if we try.  Better to separate the high-risk from the low-risk.

Yoav

[1] Claims by all those emails I’m getting telling me that I won Google’s email address lottery notwithstanding.

---

From: Ilari Liusvaara <[email-masked]>
Date: Sat, 3 Jun 2017 00:01:33 +0300

> The reasoning is that MTAs typically have certificates now (although many use self-issued) and they have DNS records, so automating the certificate issuance is clear and straight-forward.

One thing to note is that only mail-related port that is currently
allowed for "server" type validation in CABForum BRs is port 25.
So for IMAP, one would presumably want to get port 993 (IMAPS)
added to that list. And 587 (SUBMISSION) could be another
candidate.

Also, AFAIK, port 465 is not actually SMTPS, but something totally
unrelated to mail. It is also one of the dirtiest TCP port out
there. You can not assume it works even between consenting
endpoints (there are boxes that capture port 465 connections,
even if not addressed to them).

-Ilari

---

From: Roland Shoemaker <[email-masked]>
Date: Wed, 7 Jun 2017 13:58:23 -0700

Sorry I wasn't able to make it for this call, comments inline:

> Briefly discussed; Yaron requested clarification on the use-case before considering adoption.

I think there are two main use-cases for this: people who want
certificates for public IPv4/6 addresses which is not incredibly common
but is a feature offered by a number of existing commercial CAs, and is
therefore something ACME should attempt to provide parity with; and
people who want to use ACME in an internal non-public CA for generating
certificates for various services which use them for, i.e., RPC endpoint
authentication.

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
> 

-- 
Roland Bracewell Shoemaker
Software Engineer
Linux Foundation / Internet Security Research Group

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 8 Jun 2017 15:15:57 +0000

The minutes for the June 2 interim are now available:
	 https://datatracker.ietf.org/doc/minutes-interim-2017-acme-01-201706021100/

The next couple of messages will be to call for various WG adoptions and WGLC.