Subject: Re: [Acme] Support for domains with redundant but not immediately synchronized servers

From: Jonas Wielicki <[email-masked]>
Date: Thu, 21 Jan 2016 12:47:36 +0100

Hello list,

On 07.12.2015 01:32, Manger, James wrote:
>>> Ideally, it [Let's Encrypt] would use the IP of the requester 
>>> (of course only after it has verified that the IP is in the 
>>> DNS) or allow the requester to specify a preferred IP.
> 
> This is quite a sensible feature request from Jonas. It supports 
> multiple servers for a domain while encouraging keys that are tied 
> to a single piece of hardware, without adding extra coordination 
> requirements. It doesn't feel too onerous for CAs to implement.

Having the keys bound to a single piece of hardware (or administrative
sub-domain) is also what we had in mind. Thank you for bringing that
up in clearer wording.

>> There's a fairly good solution available with the current 
>> protocol, which is to serve a (long lived) redirect from 
>> /.well-known/acme-challenge/ on all of the servers to a
>> different URL that is always answered by the machine you run an
>> ACME client on.
> 
> This redirect-based workaround feels far from ideal. It assumes 1 
> server does all the ACME bits, which discourages per-hardware
> keys. It requires more coordination between servers (1 is
> different; others need its IP; need some extra mechanism to
> distribute key+cert once issued).

We totally agree. The additional coordination overhead feels
unnecessary and error prone.

I am not at all familiar with the processes in an IETF WG. What is the
way forward to get my proposal either into the protocol or officially
dismissed?

best regards,
Jonas

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 21 Jan 2016 14:13:32 +0000

> I am not at all familiar with the processes in an IETF WG. What is the way
> forward to get my proposal either into the protocol or officially dismissed?

This is the way it works. :)  People post to the mailing list and there's discussion.  At some point, the chairs will see if there is consensus to do it.

So things are working as designed.  It's informal and a bit messy.

What might help focus discussion is if you made a pull request with your specific wording changes.