Subject: [Acme] "authorized key pair" vs CSR keys

From: Anders Rundgren <[email-masked]>
Date: Thu, 18 Dec 2014 13:12:31 +0100

Dear List,

I'm trying to "decipher" this spec
https://letsencrypt.github.io/acme-spec/
but I got lost early on :-(

Does/can the CSR use another key-pair than the "authorized key pair"?

If not the outer signature seems a bit odd since the CSR itself should contain a signature.

Anders

---

From: Martin Thomson <[email-masked]>
Date: Thu, 18 Dec 2014 11:55:13 -0800

> If not the outer signature seems a bit odd since the CSR itself should

The signature in the CSR isn't enough to bind the CSR to the ACME
protocol process.  Without that, the information that appears in the
ACME context couldn't be properly attributed to the private key owner.

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 18 Dec 2014 20:58:15 +0100

> ACME context couldn't be properly attributed to the private key owner.

The authorized key pair mentioned in the spec is *another* key-pair than used for the CSR?
If not, the design appears strange to me at least.

Anders

---

From: Martin Thomson <[email-masked]>
Date: Thu, 18 Dec 2014 12:03:06 -0800

> If not, the design appears strange to me at least.

They are the same.

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 18 Dec 2014 21:07:52 +0100

>> If not, the design appears strange to me at least.

Then it is time dropping PKCS #10 and create the CSR that
ACME actually needs.

Anders