Subject: [Acme] Looking for comments on https://github.com/ietf-wg-acme/acme/issues/215

From: "Salz, Rich" <[email-masked]>
Date: Sat, 3 Dec 2016 02:18:51 +0000

With the couple of recent pull requests, the document editors are about to close all but on issue, #215.

Does the WG have any feelings on this?  Is it something we need to address NOW, or can we add a new type of challenge later on if there's interest?

Please reply on-list by earl next week.

--
Senior Architect, Akamai Technologies
Member, OpenSSL Dev Team
IM: [email-masked] Twitter: RichSalz

---

From: Patrick Figel <[email-masked]>
Date: Sat, 3 Dec 2016 13:35:23 +0100

I wrote together some thoughts on this proposal here[1]. In short, I think it's
vulnerable to the default vhost attack that caused simpleHTTP to be dropped, and
it's not compatible with the "Agreed-Upon Change to Website" method described
in the BRs, which would prevent adoption by any publicly-trusted CA.

The proposed workaround for this issue[2] would make this a variant of tls-sni,
AIUI, which already has these pseudo-hostnames, so I think we're down to "allow
other ports" here, and I believe there's consensus against this.

Patrick

[1]: https://mailarchive.ietf.org/arch/msg/acme/QiXu84RJtURfGVVEYfSpRdtcU5o
[2]: https://mailarchive.ietf.org/arch/msg/acme/NFKJ5sqBePGlJglKRwodc5m4ZEo

On Sat, Dec 3, 2016 at 3:18 AM, Salz, Rich <[email-masked]> wrote:
> Does the WG have any feelings on this?  Is it something we need to address
> NOW, or can we add a new type of challenge later on if there’s interest?
>
>
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Philipp Junghannß <[email-masked]>
Date: Sat, 3 Dec 2016 22:47:21 +0100

well I think it's a bad idea. as I commented in the issue directly
TLS-SNI-01 fell straight on the face because of the way servers may handle
hosts without a setting.

2016-12-03 13:35 GMT+01:00 Patrick Figel <[email-masked]>:

> > With the couple of recent pull requests, the document editors are about
> to
> > close all but on issue, #215.
> >
> >
> >

---

From: Richard Barnes <[email-masked]>
Date: Sat, 3 Dec 2016 17:42:54 -0500

I find these objections pretty persuasive.  Inclined to WONTFIX.

---

From: Daniel McCarney <[email-masked]>
Date: Mon, 5 Dec 2016 14:50:59 -0500

Speaking on behalf of Let's Encrypt, we wouldn't be supportive of the change
outlined in #215. We share Patrick's concerns about servers with default
vhosts.