Subject: [Acme] v2

From: Richard Barnes <[email-masked]>
Date: Tue, 13 Jun 2017 11:26:18 -0400

(Everyone get your bike shed paint out....)

In talking with a few folks around the community, I've heard people refer
to the IETF version of ACME as "v2", where implicitly "v1" is the initial
version deployed by Let's Encrypt and its clients right now.

How would people feel about reflecting this in the draft / RFC?  I've
posted a PR with the changes this would entail:

https://github.com/ietf-wg-acme/acme/pull/321

The only question this raises for me is what to do about v1.  Given that
Let's Encrypt has evolved their interface some since the first version, I'm
not sure there's one consolidated spec out there for what they currently
have deployed.  So while it would be nice to have a reference to v1 in this
document if we make it v2, I'm not inclined to worry about it too much.
I'm willing to leave it up to the LE folks if they want to submit a v1
later for historical purposes.

Any objections to merging the above PR?

--Richard

---

From: Yoav Nir <[email-masked]>
Date: Tue, 13 Jun 2017 18:51:57 +0300

Hi, Richard,

I don’t feel strongly one way or the other, but I prefer to think of what LE deployed as a PoC, like Google’s SPDY to the IETF’s HTTP/2, or like Google’s QUIC to the IETF’s… QUIC. Ot the Oakley protocol to IKE.

But if someone needs LE’s protocol to be retroactively called ACMEv1, I don’t mind.

Yoav

> On 13 Jun 2017, at 18:26, Richard Barnes <[email-masked]> wrote:
> 
> In talking with a few folks around the community, I've heard people refer to the IETF version of ACME as "v2", where implicitly "v1" is the initial version deployed by Let's Encrypt and its clients right now.
> 
> How would people feel about reflecting this in the draft / RFC?  I've posted a PR with the changes this would entail:
> 
> https://github.com/ietf-wg-acme/acme/pull/321 <https://github.com/ietf-wg-acme/acme/pull/321>
> 
> The only question this raises for me is what to do about v1.  Given that Let's Encrypt has evolved their interface some since the first version, I'm not sure there's one consolidated spec out there for what they currently have deployed.  So while it would be nice to have a reference to v1 in this document if we make it v2, I'm not inclined to worry about it too much.  I'm willing to leave it up to the LE folks if they want to submit a v1 later for historical purposes.
> 
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme

---

From: Ted Hardie <[email-masked]>
Date: Tue, 13 Jun 2017 09:00:53 -0700

> (Everyone get your bike shed paint out....)
The IETF logo has a goldenrod-colored network path in it--how about that?
Or that pay lavender?

> https://github.com/ietf-wg-acme/acme/pull/321
I would personally prefer this to be "Automatic Certificate Management
Environment (ACME), IETF Version One".  That's clear about where we are and
let's us finesse the question of what version or version there were prior
to the IETF version set starting.  As you note, there are potentially
multiple versions of the non-IETF version, given the evolution which has
occurred.

> Any objections to merging the above PR?
In case it was not clear, my opinion above was as an individual.

Ted

---

From: Martin Thomson <[email-masked]>
Date: Tue, 13 Jun 2017 17:54:26 +0100

I don't see the distinction between what LE deploy and ACME as defined
by the IETF being any different to the distinction between whatever
any other CA currently deploy and the IETF spec.  It's a thing that
exists, but I see no reason to accord the LE proprietary protocol any
special status other than by acknowledging provenance.

This is the IETF version of ACME, and as such it needs no version
qualification.  I doubt that there will be any confusion from this
being deployed alongside the proprietary LE protocol.

On 13 June 2017 at 16:26, Richard Barnes <[email-masked]> wrote:
> In talking with a few folks around the community, I've heard people refer to
> the IETF version of ACME as "v2", where implicitly "v1" is the initial
> document if we make it v2, I'm not inclined to worry about it too much.  I'm
> willing to leave it up to the LE folks if they want to submit a v1 later for
> historical purposes.
>

---

From: Daniel McCarney <[email-masked]>
Date: Tue, 13 Jun 2017 13:36:24 -0400

>
> Given that Let's Encrypt has evolved their interface some since the first
> version, I'm not sure there's one consolidated spec out there for what they
> currently have deployed.

There isn't AFAIK - the closest thing is the list of "boulder divergences"
we maintain along with the current-most draft:
https://github.com/letsencrypt/boulder/blob/master/docs/acme-divergences.md

> later for historical purposes.

I suspect that since LE & Boulder evolved alongside the drafts its probably
more trouble than its worth to try and create a snapshot of a specific
point in LE's existence to describe the protocol at that point.

---

From: Daniel McCarney <[email-masked]>
Date: Tue, 13 Jun 2017 13:39:41 -0400

>
> I don't see the distinction between what LE deploy and ACME as defined by
> the IETF being any different to the distinction between whatever any
> other CA currently deploy and the IETF spec.

The relatively ad-hoc things that CAs deploy today aren't referred to as
ACME, or used by what people refer to as ACME clients. I don't think its a
fair comparison to the situation we're in today where there are a number of
clients that call themselves "ACME clients" written to work with "ACME v1"
who are likely to be confused by the fact their clients don't work
out-of-box with IETF ACME.

I doubt that there will be any confusion from this being deployed alongside
> the proprietary LE protocol

I disagree. There is already fairly substantial confusion among client
developers, server developers and users about what ACME is and how it
relates to the Let's Encrypt service.

On Tue, Jun 13, 2017 at 12:54 PM, Martin Thomson <[email-masked]>
wrote:

> I'm

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 14 Jun 2017 09:49:36 +0100

I agree with MT here. We should just name it v1. That's what IETF change
control means

---

From: Richard Barnes <[email-masked]>
Date: Wed, 14 Jun 2017 18:39:18 -0400

For some context: https://letsencrypt.org/2017/06/14/acme-v2-api.html

To be clear about my opinion here: I'm not super enthusiastic about v2; I
think we can muddle through the transition just fine.  But if people feel
strongly that it would help to have a clear version (there's not even a
"v1" notation right now), that would be OK with me.

---

From: Richard Barnes <[email-masked]>
Date: Wed, 21 Jun 2017 12:30:39 -0400

OK, I'm not hearing any real enthusiasm for this idea (except from
Daniel).  So I'm going to close the PR.

On Wed, Jun 14, 2017 at 6:39 PM, Richard Barnes <[email-masked]> wrote:

>> On Tue, Jun 13, 2017 at 5:54 PM, Martin Thomson <[email-masked]
>> > wrote:
>>