Draft: draft-ietf-acme-acme

Commentary: Fix reference to old , partial , URL integrity mechanism . Remove line about distinct URLs for singular resources , as there is no mechanism for this now . Standardize on rather than ; previously there was a mix . Replace /acme / acct / asdf in examples with /acme / acct/1 . Fix a few miscellaneous errors . Renumber a list to use correct numbers . 
 My plan is to replace other uses of in subsequent PRs . 
 Now is the only abbreviated one as far as I can see , so that should probably be adjusted to , too ? 
 Per in . 
 Closing after discussion at IETF 98 .
Paragraph (version A):
These intermediaries can also change values in the request that are
not signed in the HTTPS request, e.g., the request URI and headers.
ACME uses JWS to provide a limited integrity mechanism, which
protects against an intermediary changing the request URI to another
ACME URI of a different type.  (It does not protect against changing
between URIs of the same type, e.g., from one authorization URI to
another).
Paragraph (version B):
These intermediaries can also change values in the request that are
not signed in the HTTPS request, e.g., the request URI and headers.
ACME uses JWS to provide an integrity mechanism, which protects
against an intermediary changing the request URI to another ACME URI.
Paragraph (version A):
The "url" header parameter specifies the URL to which this JWS object
is directed RFC3986.  The "url" parameter MUST be carried in the
protected header of the JWS.  The value of the "url" header MUST be a
JSON string representing the URL.
Paragraph (version B):
The "url" header parameter specifies the URL RFC3986 to which this
JWS object is directed.  The "url" parameter MUST be carried in the
protected header of the JWS.  The value of the "url" header MUST be a
JSON string representing the URL.
Paragraph (version A):
Creation of resources can be rate limited to ensure fair usage and
prevent abuse.  Once the rate limit is exceeded, the server MUST
respond with an error with the code "rateLimited".  Additionally, the
server SHOULD send a "Retry-After" header indicating when the current
request may succeed again.  If multiple rate limits are in place,
that is the time where all rate limits allow access again for the
current request with exactly the same parameters.
Paragraph (version B):
Creation of resources can be rate limited to ensure fair usage and
prevent abuse.  Once the rate limit is exceeded, the server MUST
respond with an error with the type
"urn:ietf:params:acme:error:rateLimited".  Additionally, the server
SHOULD send a "Retry-After" header indicating when the current
request may succeed again.  If multiple rate limits are in place,
that is the time where all rate limits allow access again for the
current request with exactly the same parameters.
Paragraph (version A):
This list is not exhaustive.  The server MAY return errors whose
"type" field is set to a URI other than those defined above.  Servers
MUST NOT use the ACME URN namespace for errors other than the
standard types.  Clients SHOULD display the "detail" field of such
errors.
Paragraph (version B):
This list is not exhaustive.  The server MAY return errors whose
"type" field is set to a URI other than those defined above.  Servers
MUST NOT use the ACME URN namespace for errors other than the
standard types.  Clients SHOULD display the "detail" field of all
errors.
Paragraph (version A):
For the singular resources above ("directory", "new-nonce", "new-
account", "new-order", "revoke-certificate", and "key-change") the
resource may be addressed by multiple URIs, but all must provide
equivalent functionality.
Paragraph (version A):
The public key of the account key pair, encoded as a JSON Web Key
object RFC7517.  This field is not updateable by the client.
Paragraph (version B):
The public key of the account's key pair, encoded as a JSON Web
Key object RFC7517.  The client may not directly update this
field, but must use the key-change resource instead.
Paragraph (version A):
An array of URIs that the server can use to contact the client for
issues related to this authorization.  For example, the server may
wish to notify the client about server-initiated revocation.
Paragraph (version B):
An array of URIs that the server can use to contact the client for
issues related to this account.  For example, the server may wish
to notify the client about server-initiated revocation or
certificate expiration.
Paragraph (version A):
The only type of identifier defined by this specification is a fully-
qualified domain name (type: "dns").  The value of the identifier
MUST be the ASCII representation of the domain name.  If a domain
name contains Unicode characters it MUST be encoded using the rules
defined in RFC3492.  Servers MUST verify any identifier values that
begin with the ASCII Compatible Encoding prefix "xn-" as defined in
RFC5890 are properly encoded.  Wildcard domain names (with "*" as the
first label) MUST NOT be included in authorization requests.
Paragraph (version B):
The only type of identifier defined by this specification is a fully-
qualified domain name (type: "dns").  The value of the identifier
MUST be the ASCII representation of the domain name.  If a domain
name contains Unicode characters it MUST be encoded using the rules
defined in RFC3492.  Servers MUST verify any identifier values that
begin with the ASCII Compatible Encoding prefix "xn-" as defined in
RFC5890 are properly encoded.  Wildcard domain names (with "*" as the
first label) MUST NOT be included in authorization objects.
Paragraph (version A):
Caching of responses from the new-nonce resource can cause clients to
be unable to communicate with the ACME server.  The server MUST
include a Cache-Control header field with the "no-store" directive in
responses for the new-nonce resource, in order to prevent caching of
this resource.
Paragraph (version B):
Proxy caching of responses from the new-nonce resource can cause
clients receive the same nonce repeatedly, leading to badNonce
errors.  The server MUST include a Cache-Control header field with
the "no-store" directive in responses for the new-nonce resource, in
order to prevent caching of this resource.