Subject: [Acme] ACME v06 - Pre-Authorization

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Wed, 7 Jun 2017 08:50:28 -0400

Hi,

I am exploring the idea of using ACME for issuing certificates for
endpoints using the Pre-Authorization process, and I have a question about
that process.

I reviewed the editor's version published May 22, 2017.

Section 7.4.1. Pre-Authorization states that after the client sends a
request and received a valid response, that the client would then follow
the process of section 7.5 Identifier Authorization. This seems to assume
that the client will be able to complete the authorization process before
it sends the certificate issuance request, and without the involvement of
the virtual server (or endpoint in my case).

What is the expected behavior of the server if the client sends the
certificate issuance request after it sends the pre-authorization request
but
before it completes the pre-authorization process?

Also, since the pre-authorization process is expected to deal with multiple
servers/endpoints requesting certificates, should this process be enhanced
to support bulk requests?

Nits:

* Section 7.3.5, first paragraph, second line:
  A "bind" word is missing between the words "to" and "an"

* Section 7.4.1,
  - second paragraph, second sentence: "case" should be "cases".
  - When the server builds the authorization object, the document is
    stating that the response would include "challenges" and "combinations".
    Remove the "combinations" as it is not being used.

* Section 7.5.1, the Request URIs in the examples:
  Should not this be /acme/authz/1234/0?

Regards,
 Rifaat

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Mon, 26 Jun 2017 14:11:11 -0700

On 06/07/2017 05:50 AM, Rifaat Shekh-Yusef wrote:
> certificate issuance request after it sends the pre-authorization
> request but 
By "certificate issuance request," I assume you mean the "new-order"
request? The server would create an order object with one or more
authorizations objects that need to be fulfilled. Once those
authorizations became valid, the server would issue the certificate. In
other words, this is equivalent to the default flow without
pre-authorization.

> to support bulk requests?
I don't understand this question. Can you clarify? What sort of
enhancement are you imagining?
> Nits:
Filed an issue: https://github.com/ietf-wg-acme/acme/issues/330

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 27 Jun 2017 08:15:04 -0400

On Mon, Jun 26, 2017 at 5:11 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

> request?

Yes

> The server would create an order object with one or more
> authorizations objects that need to be fulfilled.

My point is that the pre-authorization request (i.e. new-authz) would have
already created
a pending authorization object with the challenges for the client.

I am assuming that when the server responds to the new-order request, it
would provide the same
challenges provided in the new-authz request; correct?
In any case, I think this should be clearly specified in the document.

> Once those

What I have in mind for this is that ACME client might be representing more
than one entity
when it is using the pre-authorization procedure, as specified in section
7.4.1.

The use case I have in mind is to use this pre-authorization mechanism for
a client to issue certificates
for large number of *endpoints*.

Instead of sending a new-authz request per endpoint, it might be useful to
allow the client to send one
request for a list of endpoints.

Regards,
 Rifaat

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Tue, 27 Jun 2017 11:29:34 -0700

On 06/27/2017 05:15 AM, Rifaat Shekh-Yusef wrote:
> My point is that the pre-authorization request (i.e. new-authz) would
> have already created 
The ACME server MAY reuse existing pending authorizations, or it may
create new ones. You should not rely on the pending authorizations that
result from a new-order request being the same as ones previously
created by new-authz requests.

>
> What I have in mind for this is that ACME client might be representing
> more than one entity 
> when it is using the pre-authorization procedure, as specified in
> section 7.4.1.
>
> The use case I have in mind is to use this pre-authorization mechanism
> for a client to issue certificates
> Instead of sending a new-authz request per endpoint, it might be
> useful to allow the client to send one 
I'm not clear what you mean by entity and endpoint in this question. Are
you thinking of people, machines, companies, DNS names, IP addresses, or
something else?

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 27 Jun 2017 15:05:29 -0400

On Tue, Jun 27, 2017 at 2:29 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

> result from a new-order request being the same as ones previously created
> by new-authz requests.
>
>
Fair enough.
What would be the response from the server when it reuses existing pending
authorization? 200 OK with the existing challenge?
Could that be spelled out in the document?

> you thinking of people, machines, companies, DNS names, IP addresses, or

I am thinking of hard endpoints, like deskphones, mobile devices, etc.
I am working on an ACME endpoint extension draft that I would like to
discuss later that hopefully clarifies the use case and how I think it
could fit into the ACME mechanism.

Regards,
 Rifaat