Subject: [Acme] How automated should ACME be?

From: Trevor Freeman <[email-masked]>
Date: Mon, 01 Dec 2014 13:01:20 -0800

To digress from the  ASN.1 woes discussion, I would like to ask some higher
level question:   

How automated should ACME be?

What are the set of automated scenarios we want ACME to support?

If I am managing n servers, how automated can I expect the management of
those n servers to be?

If I wanted to add a new type of certificate to my servers, how many places
do I need to visit to make that happen?

What I don't see in ACME at the preset is the management request\response
pair that would for instance exchange information to enable an ACME client
to create certificate requests e.g. what algorithm, parameters etc. 

ACME is establishing DV scoped RAs. Tying the authentication of the RA to a
specific form of authentication seems a little retro. We need a strong form
of authentication for the RA, but why don't we tokenize the RA
authentication to make ACME support multiple ways to authenticate? 

Trevor

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 1 Dec 2014 16:31:35 -0500

On Mon, Dec 1, 2014 at 4:01 PM, Trevor Freeman
<[email-masked]> wrote:

> of authentication for the RA, but why don’t we tokenize the RA

+1

I don't see any reason to limit an enrollment protocol to one
particular validation scheme or for that matter one particular role.
If a protocol requires major redesign to support other validation
processes or S/MIME versus TLS then we are doing it wrong.

We are going to need the flexibility for IPR reasons if nothing else.