jiebi/TextFlow huggingface dataset:
Original text:
successful.  If no DNS record is found, or DNS record and response payload do not pass these checks, then the validation fails.  8. [[ Editor's Note: Should we create a registry for tokens that go into

Reviewer comments:
We need a challenge type to cover types of validation that can't be done automatically, in band to ACME. For example, a CA doing OV or EV validation might need the applicant to upload some documents through a web form. We should add a generic "out-of-band" challenge type that has a URL for a web site where the applicant gan go for instructions. I think the challenge object would look something like: There would be no response object; you just click the link, and when you complete the instructions there, the CA reflects this in the "status" field of the challenge object.
A few months back I wrote up a for this idea -- the hope is that ACME could evolve to become the language that all cert issuers talk to support a standard for cert management and exchange.
At IETF 95, agreed that this seemed reasonable to pursue, but needs to have a PR that describes what the URI characteristics are.

Revised text:
successful.  If no DNS record is found, or DNS record and response payload do not pass these checks, then the validation fails. <ins> 7.5. There may be cases where a server cannot perform automated validation of an identifier, for example if validation requires some manual steps.  In such cases, the server may provide an "out of band" (OOB) challenge to request that the client perform some action outside of ACME in order to validate possession of the identifier. The OOB challenge requests that the client have a human user visit a web page to receive instructions on how to validate possession of the identifier, by providing a URL for that web page. The string "oob-01" The URL to be visited.  The scheme of this URL MUST be "http" or "https" A client responds to this challenge by presenting the indicated URL for a human user to navigate to.  If the user choses to complete this challege (by vising the website and completing its instructions), the client indicates this by sending a simple acknowledgement response to the server. The string "oob-01" On receiving a response, the server MUST verify that the value of the "type" field is as required.  Otherwise, the steps the server takes to validate identifier possession are determined by the server's local policy. </ins> 8. [[ Editor's Note: Should we create a registry for tokens that go into
Original text:
The string "reg", indicating an update to the registration. <del> The JWK thumbprint of the old key RFC7638, base64url-encoded </del>  <del> The client signs this object with the new key pair and encodes the </del>  object and signature as a JWS.  The client then sends this JWS to the <del> server in the "newKey" field of a request to update the registration. </del>  <del> On receiving a request to the registration URL with the "newKey" </del>  attribute set, the server MUST perform the following steps: <del> Check that the contents of the "newKey" attribute are a valid JWS </del>  <del> Check that the "newKey" JWS verifies using the key in the "jwk" header parameter of the JWS </del>  Check that the payload of the JWS is a valid JSON object Check that the "resource" field of the object has the value "reg" <del> Check that the "oldKey" field of the object contains the JWK thumbprint of the account key for this registration </del>  If all of these checks pass, then the server updates the registration by replacing the old account key with the public key carried in the <del> "jwk" header parameter of the "newKey" JWS object. </del>  If the update was successful, then the server sends a response with status code 200 (OK) and the updated registration object as its body.

Reviewer comments:
As discussed in the thread about , we can have a fairly clean recovery story (assuming a MAC key can be provisioned. As a first step, we should reverse the order of the signatures in the roll-over request object. Just wanted to make sure everyone is aware that there's an ACME F2F meeting happening at the IETF this afternoon, 17:40-19:40 Argentina Time (13:40-15:40 US Pacific, 20:40-22:40 UTC). URL Remote participation is possible. You can find links to audio streaming, XMPP chat, and a MeetEcho room in ACME line on the above agenda page. See you there! --Richard

Revised text:
The string "reg", indicating an update to the registration.  <ins> The JWK thumbprint of the new key RFC7638, base64url-encoded </ins>  <ins> The client signs this object with the old key pair and encodes the </ins> object and signature as a JWS.  The client then sends this JWS to the  <ins> server in the "rollover" field of a request to update the registration. </ins>  <ins> On receiving a request to the registration URL with the "rollover" </ins> attribute set, the server MUST perform the following steps:  <ins> Check that the contents of the "rollover" attribute are a valid JWS </ins>  <ins> Check that the "rollover" JWS verifies using the account key correspdonding to this registration </ins> Check that the payload of the JWS is a valid JSON object Check that the "resource" field of the object has the value "reg"  <ins> Check that the "newKey" field of the object contains the JWK thumbprint of the account key used to sign the request </ins> If all of these checks pass, then the server updates the registration by replacing the old account key with the public key carried in the  <ins> "jwk" header of the request JWS. </ins> If the update was successful, then the server sends a response with status code 200 (OK) and the updated registration object as its body.
Original text:
As a domain may resolve to multiple IPv4 and IPv6 addresses, the server will connect to at least one of the hosts found in A and AAAA <del> records.  Because many web servers allocate a default HTTPS virtual host to a particular low-privilege tenant user in a subtle and non- intuitive manner, the challenge must be completed over HTTP, not HTTPS. </del>  The string "http-01" The key authorization for this challenge.  This value MUST match the token from the challenge and the client's account key. <del> An IPv4 or IPv6 address, in dotted decimal form or RFC4291 form, respectively.  If given, this address MUST be included in the set of IP addresses to which the domain name resolves when the server attempts validation.  If given, the server SHOULD connect to that specific IP address instead of arbitrarily choosing an IP from the set of A and AAAA records to which the domain name resolves. </del> On receiving a response, the server MUST verify that the key authorization in the response matches the "token" value in the challenge and the client's account key.  If they do not match, then Verify that the resulting URI is well-formed. <del> If the client has supplied an address to use, verify that the address is included in the A or AAAA records to which the domain name resolves.  If the address is not included in the result, the validation fails. Dereference the URI using an HTTP GET request.  If an address was supplied by the client, use that address to establish the HTTP connection. </del>  Verify that the body of the response is well-formed key authorization.  The server SHOULD ignore whitespace characters at

Reviewer comments:
This reverts commit a5cb357a64ce5e46815544c9faaf94b97b3eba56 I think we did not reach consensus on the list about this feature.
Oh, it's a shame that this was removed. I was hoping to use this feature to help when my servers were behind a load balancer. We should probably remove this reference as well:

Revised text:
As a domain may resolve to multiple IPv4 and IPv6 addresses, the server will connect to at least one of the hosts found in A and AAAA  <ins> records, at its discretion.  Because many webservers allocate a default HTTPS virtual host to a particular low-privilege tenant user in a subtle and non-intuitive manner, the challenge must be completed over HTTP, not HTTPS. </ins> The string "http-01" The key authorization for this challenge.  This value MUST match the token from the challenge and the client's account key.  On receiving a response, the server MUST verify that the key authorization in the response matches the "token" value in the challenge and the client's account key.  If they do not match, then Verify that the resulting URI is well-formed.  <ins> Dereference the URI using an HTTP GET request. </ins> Verify that the body of the response is well-formed key authorization.  The server SHOULD ignore whitespace characters at
Original text:
registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise. <del> To change the key associate with an account, the client POSTs a key- change object with a "key" field containing a JWK representation of the new public key.  The JWS of this POST must have two signatures: one signature from the existing key on the account, and one signature from the new key that the client proposes to use.  This demonstrates that the client actually has control of the private key corresponding to the new public key.  The protected header must contain a JWK field containing the current account key. </del>  On receiving key-change request, the server MUST perform the following steps in addition to the typical JWS validation:

Reviewer comments:
The current mechanism has a potential copy/paste vulnerability. Karthik proposed on the list: That is, you need the full matrix of "X signs over Y" -- "new/old", "new/new", "old/old", "old/new" -- so that both sides explicitly agree to the (old, new) pair. But the current design has only has "old/new" and "new/new". That raises a risk that if you got an "old/new" signature, you could copy/paste the "new/new" signature and get a valid request. As long as we have parallel signatures (cf. ), we need to have both the old and new keys in the payloads.

Revised text:
registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise.  <ins> To change the key associate with an account, the client sends a POST request containing a key-change object with the following fields: The JWS representation of the original key (i.e., the client's current account key) The JWS representation of the new key The JWS of this POST must have two signatures: one signature from the existing key on the account, and one signature from the new key that the client proposes to use.  This demonstrates that the client actually has control of the private key corresponding to the new public key.  The protected header must contain a JWK field containing the current account key. </ins> On receiving key-change request, the server MUST perform the following steps in addition to the typical JWS validation:
Original text:
registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise. <del> To change the key associate with an account, the client sends a POST </del>  request containing a key-change object with the following fields: The JWK representation of the original key (i.e., the client's On receiving key-change request, the server MUST perform the following steps in addition to the typical JWS validation: <del> Check that the JWS protected header container a "jwk" field </del>  containing a key that matches a currently active account. Check that there are exactly two signatures on the JWS.

Reviewer comments:
Fixing two minor typos in Section 6.2.1 "Account Key Roll-over"

Revised text:
registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise.  <ins> To change the key associated with an account, the client sends a POST </ins> request containing a key-change object with the following fields: The JWK representation of the original key (i.e., the client's On receiving key-change request, the server MUST perform the following steps in addition to the typical JWS validation:  <ins> Check that the JWS protected header contains a "jwk" field </ins> containing a key that matches a currently active account. Check that there are exactly two signatures on the JWS.
Original text:
field. If the server already has a registration object with the provided <del> account key, then it MUST return a 409 (Conflict) response and provide the URI of that registration in a Location header field. This allows a client that has an account key but not the corresponding registration URI to recover the registration URI. </del>  If the server wishes to present the client with terms under which the ACME service is to be used, it MUST indicate the URI where such terms

Reviewer comments:
It seem like the only way to retrieve an existing registration object for a given key is to provoke an error by attempting to register again with the same key and read the Location from it. As a client library implementor, I would expect to and to not be recoverable. I think its strange that the only way to recover the registration object is by triggering an error. Would it make sense to add an extra endpoint to simply retrieve the registration object? Alternatively, I don't see any reason for the endpoint not to return when already registered (instead of when it create the registration) as opposed to a . Also, the returned error type in boulder is , which does not make much sense to me since the request was not malformed. If its an expected behaviour to provoke an error to recover data from the response, the error type should be specify into the spec and unique so its can be recovered from easily. Implementation in boulder and initial discussion in the ruby .

Revised text:
field. If the server already has a registration object with the provided  <ins> account key, then it MUST return a 200 (OK) response and provide the URI of that registration in a Content-Location header field.  This allows a client that has an account key but not the corresponding registration URI to recover the registration URI. </ins> If the server wishes to present the client with terms under which the ACME service is to be used, it MUST indicate the URI where such terms
Original text:
server MUST reject the request as unauthorized. Except for the directory resource, all ACME resources are addressed <del> with URLs provided to the client by the server.  In such cases, the client MUST set the "url" field to the exact string provided by the server (rather than performing any re-encoding on the URL). </del>  5.3.1.

Reviewer comments:
As discussed at IETF 96, ACME server processing of the "url" field should perform an exact string equality test between the URL string provided to the client and the string provided by the client in its "url" parameter. Effectively, this turns "url" values into opaque service labels, which just happen to have the side effect of being able to direct an HTTP request.

Revised text:
server MUST reject the request as unauthorized. Except for the directory resource, all ACME resources are addressed  <ins> with URLs provided to the client by the server.  For these resources, the client MUST set the "url" field to the exact string provided by the server (rather than performing any re-encoding on the URL).  The server SHOULD perform the corresponding string equality check, configuring each resource with the URL string provided to clients and having the resource check that requests have the same string in their "url" fields. </ins> 5.3.1.
Original text:
Link header with link relation "next" indicating a URL to retrieve further entries. <del> A URI from which a list of certificates issued for this account can be fetched via a GET request.  The result of the GET request MUST be a JSON object whose "certificates" field is an array of strings, where each string is the URI of a certificate.  The server SHOULD NOT include expired or revoked certificates.  The server MAY return an incomplete list, along with a Link header with link relation "next" indicating a URL to retrieve further entries. </del> 6.1.3. An ACME registration resource represents a client's request for a

Reviewer comments:
The registration object already contains a list of certificate applications, and each application contains a link to the resulting certificate if one was issued. This reduces the number of primitives that an ACME server has to support.

Revised text:
Link header with link relation "next" indicating a URL to retrieve further entries.  6.1.3. An ACME registration resource represents a client's request for a
Original text:
A "key-change" resource <del> For the "new-X" resources above, the server MUST have exactly one resource for each function.  This resource may be addressed by multiple URIs, but all must provide equivalent functionality. </del>  ACME uses different URIs for different management functions.  Each function is listed in a directory along with its corresponding URI,

Reviewer comments:
Prior to this PR the specification seems to be contradictory, indicating that the "new-X" resources must not be duplicated, but that they can live at different URIs. It's not clear to me what this MUST is trying to prevent, especially in light of an allowance of multiple URIs if functionality is equivalent. Similarly, while the text prior to this PR says "new-X" I believe the intentions of the statements that follow would include some of the resources that have been added since, e.g. "key-change". This PR updates the "new-X" language to include the additional singular resources and removes the MUST. If I've missed the mark in this clarification perhaps someone who was involved with the spec at the time of this paragraph's writing can help guide us to something both clear & accurate to the original spirit.

Revised text:
A "key-change" resource  <ins> For the singular resources above ("directory", "new-registration", "new-application", "revoke-certificate", and "key-change") the resource may be addressed by multiple URIs, but all must provide equivalent functionality. </ins> ACME uses different URIs for different management functions.  Each function is listed in a directory along with its corresponding URI,
Original text:
The string "proofOfPossession-01" <del> An array of certificates, in Base64-encoded DER format, that </del>  contain acceptable public keys. In response to this challenge, the client uses the private key

Reviewer comments:
They should be base64url rather than base64, for symmetry with rest of spec.
Don't think this is totally necessary, since we say at the front that when we say "base64", we mean the special variant. But happy to be clearer here.

Revised text:
The string "proofOfPossession-01"  <ins> An array of certificates, in Base64url-encoded DER format, that </ins> contain acceptable public keys. In response to this challenge, the client uses the private key
Original text:
If the server wishes to present the client with terms under which the ACME service is to be used, it MUST indicate the URI where such terms can be accessed in the "terms-of-service" subfield of the "meta" <del> field in the directory object, and the server SHOULD reject new- registration requests that do not contain "terms-of-service-agreed": true. </del>  If the client wishes to update this information in the future, it sends a POST request with updated information to the registration 6.3.1.  A client may wish to change the public key that is associated with a registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise. responds with an error status code and a problem document describing the error. <del> 6.3.2. </del>  A client may deactivate an account by posting a signed update to the server with a status field of "deactivated."  Clients may wish to do

Reviewer comments:
Right now, it's not clear when the client needs to agree to the server's terms, and what the server should do if it needs the client to re-agree. This PR addresses both with a dedicated error code and some related behaviors.

Revised text:
If the server wishes to present the client with terms under which the ACME service is to be used, it MUST indicate the URI where such terms can be accessed in the "terms-of-service" subfield of the "meta"  <ins> field in the directory object, and the server MUST reject new- registration requests that do not have the "terms-of-service-agreed" set to "true". </ins> If the client wishes to update this information in the future, it sends a POST request with updated information to the registration 6.3.1. <ins> As described above, a client can indicate its agreement with the CA's terms of service by setting the "terms-of-service-agreed" field in its registration object to "true". If the server has changed its terms of service since a client initially agreed, and the server is unwilling to process a request without explicit agreement to the new terms, then it MUST return an error response with status code 403 (Forbidden) and type "urn:ietf:params:acme:error:agreementRequired".  This response MUST include a Link header with link relation "terms-of-service" and the latest terms-of-service URL. The problem document returned with the error MUST also include an "instance" field, indicating a URL that the client should direct a human user to visit in order for instructions on how to agree to the terms. 6.3.2. </ins> A client may wish to change the public key that is associated with a registration in order to recover from a key compromise or proactively mitigate the impact of an unnoticed key compromise. responds with an error status code and a problem document describing the error.  <ins> 6.3.3. </ins> A client may deactivate an account by posting a signed update to the server with a status field of "deactivated."  Clients may wish to do
Original text:
The only type of identifier defined by this specification is a fully- qualified domain name (type: "dns").  The value of the identifier <del> MUST be the ASCII representation of the domain name.  Wildcard domain names (with "*" as the first label) MUST NOT be included in authorization requests. </del>  6.2.

Reviewer comments:
requires IDNs be encoded in this way in order to be stored in the X509 certificate dNSNames field. Compliance with this RFC is one of the requirements of the CABForum which CAs are expected to adhere to. We already require domain names transmitted via ACME to use the ASCII encoding, this just formalizes how IDNs should be converted.

Revised text:
The only type of identifier defined by this specification is a fully- qualified domain name (type: "dns").  The value of the identifier  <ins> MUST be the ASCII representation of the domain name.  If a domain name contains Unicode characters it MUST be encoded using the rules defined in RFC3492.  Servers MUST verify any identifier values that begin with the ASCII Compatible Encoding prefix "xn-" as defined in RFC5890 are properly encoded.  Wildcard domain names (with "*" as the first label) MUST NOT be included in authorization requests. </ins> 6.2.