Subject: [Acme] The path to the "directory" resource should not be "/" and should be specified in draft-ietf-acme-acme-01

From: Albert ARIBAUD <[email-masked]>
Date: Fri, 8 Jan 2016 20:49:56 +0100

Hello all (and a happy New Year),

I am looking at draft-ietf-acme-acme-01 as available on github right
now, more precisely at section 6.2 and the "directory" resource which
would allow a client to find out the URIs for other resources.

Since "directory" is there to help find URIs for resources, it must
itself be at a know URI.

draft-ietf-acme-acme-01 states:

	In order to help clients configure themselves with the right
	URIs for each ACME operation, ACME servers provide a directory
	object. This should be the root URL with which clients are
	configured.

The question is, what exactly is the "root URL"? At first thought it
would be the "/" path on the server.

But for "/", https://acme-v01.api.letsencrypt.org returns an HTML page
which, among other human-targeted information, mentions that the ACME
directory is at "/directory". Which makes acme-v01.api.letsencrypt.org
non-compliant to draft-ietf-acme-acme-01.

Keeping "/" as a browser-renderable "front page" for a server makes
sense, so my opinion is that placing the directory at a pre-decided,
non-root URL would be a sensible choice and draft-ietf-acme-acme-01
should specify the path where ACME clients would find the ACME
directory (and "/acme" might be a possible candidate IMO).

Or did I get the whole thing wrong?

Amicalement,
-- 
Albert.

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 8 Jan 2016 19:52:34 +0000

> The question is, what exactly is the "root URL"? At first thought it would be
> the "/" path on the server.

The wording misled you, and perhaps should be fixed.  It's more like the "subroot for the ACME tree" or something.

---

From: Albert ARIBAUD <[email-masked]>
Date: Fri, 8 Jan 2016 21:33:30 +0100

Hi Rich,

Le Fri, 8 Jan 2016 19:52:34 +0000
"Salz, Rich" <[email-masked]> a écrit:

> > 	URIs for each ACME operation, ACME servers provide a
> > directory object. This should be the root URL with which clients are
> > 	configured.
> > 
> > The question is, what exactly is the "root URL"? At first thought
> > it would be the "/" path on the server.
> 
> The wording misled you, and perhaps should be fixed.  It's more like
> the "subroot for the ACME tree" or something.

Can I offer a pull request on github with a fix?

(note: acme-v01.api.letsencrypt.org would still not match the draft)

Amicalement,
-- 
Albert.

---

From: Albert ARIBAUD <[email-masked]>
Date: Fri, 8 Jan 2016 22:46:55 +0100

Hi again,

Le Fri, 8 Jan 2016 21:33:30 +0100
Albert ARIBAUD <[email-masked]> a écrit:

> > > 	In order to help clients configure themselves with the
> > > right URIs for each ACME operation, ACME servers provide a
> > > directory object. This should be the root URL with which clients
> > > are configured.
> > > 

Done : https://github.com/ietf-wg-acme/acme/pull/66

> (note: acme-v01.api.letsencrypt.org would still not match the draft)

Actually, I withdraw this statement: acme-v01.api.letsencrypt.org's
"/directory" is just as compliant as "/acme" or "/". There is no
reason to constrain the path of the directory object to a specific
value.

In fact, not constraining the directory path allows running several
ACME servers on a single HTTP host (if anyone finds a need for that),
as long as each server has a unique directory URL (and unique
resource URIs, to avoid collisions with other ACME servers).

Amicalement,
-- 
Albert.

---

From: Martin Thomson <[email-masked]>
Date: Sat, 9 Jan 2016 09:58:37 +1100

> resource URIs, to avoid collisions with other ACME servers).

That's right.  This string
"https://acme-v01.api.letsencrypt.org/directory" is what you need to
know to use the LE service.  That part isn't subject to
standardization.