Draft: draft-ietf-acme-acme

Commentary: Looks good to me . I did n't necessarily expect the bit about de - provisioning a challenge response to need a SHOULD , but I do n't object . 
 Thanks With approval from co - author , chair , and AD , I guess it 's safe to merge :) 
 So the de - provision is n't just editorial , but it is only a SHOULD . All of these look fine to me . LGTM : rocket : Thanks
Mailing list commentary: has entered the following ballot position for draft - ietf - acme - acme-14 : Yes When responding , please keep the subject line intact and reply to all email addresses included in the To and CC lines . ( Feel free to cut this introductory paragraph , however . ) Please refer to for more information about IESG DISCUSS and COMMENT positions . The document , along with other ballot positions , can be found here :
Paragraph (version A):
The guiding use case for ACME is obtaining certificates for websites
(HTTPS RFC2818).  In this case, the user's web server is intended to
speak for one or more domains, and the process of certificate
issuance is intended to verify that this web server actually speaks
for the domain(s).
Paragraph (version B):
The guiding use case for ACME is obtaining certificates for websites
(HTTPS RFC2818).  In this case, a web server is intended to speak for
one or more domains, and the process of certificate issuance is
intended to verify that this web server actually speaks for the
domain(s).
Paragraph (version A):
In most HTTPS transactions used by ACME, the ACME client is the HTTPS
client and the ACME server is the HTTPS server.  The ACME server acts
as an HTTP and HTTPS client when validating challenges via HTTP.
Paragraph (version B):
In most HTTPS transactions used by ACME, the ACME client is the HTTPS
client and the ACME server is the HTTPS server.  The ACME server acts
as a client when validating challenges: an HTTP client when
validating an 'http-01' challenge, a DNS client with 'dns-01', etc.
Paragraph (version A):
If the server wishes to present the client with terms under which the
ACME service is to be used, it MUST indicate the URL where such terms
can be accessed in the "termsOfService" subfield of the "meta" field
in the directory object, and the server MUST reject new-account
requests that do not have the "termsOfServiceAgreed" field set to
"true".  Clients SHOULD NOT automatically agree to terms by default.
Rather, they SHOULD require some user interaction for agreement to
terms.
Paragraph (version B):
If the server wishes to require the client to agree to terms under
which the ACME service is to be used, it MUST indicate the URL where
such terms can be accessed in the "termsOfService" subfield of the
"meta" field in the directory object, and the server MUST reject new-
account requests that do not have the "termsOfServiceAgreed" field
set to "true".  Clients SHOULD NOT automatically agree to terms by
default.  Rather, they SHOULD require some user interaction for
agreement to terms.
Paragraph (version A):
The inner JWS is NOT REQUIRED to have a "nonce" header parameter.
The server MUST ignore any value provided for the "nonce" header
parameter.
Paragraph (version B):
The inner JWS MAY omit the "nonce" header parameter.  The server
MUST ignore any value provided for the "nonce" header parameter.
Paragraph (version B):
The client SHOULD de-provision the resource provisioned for this
challenge once the challenge is complete, i.e., once the "status"
field of the challenge has the value "valid" or "invalid".
Paragraph (version B):
The client SHOULD de-provision the resource record(s) provisioned for
this challenge once the challenge is complete, i.e., once the
"status" field of the challenge has the value "valid" or "invalid".
Paragraph (version A):
It is RECOMMENDED that the server perform DNS queries and make HTTP
connections from various network perspectives, in order to make MitM
attacks harder.
Paragraph (version B):
Attackers can also exploit vulnerabilities in Internet routing
protocols to gain access to the validation channel (see, e.g.,
RFC7132).  In order to make such attacks more difficult, it is
RECOMMENDED that the server perform DNS queries and make HTTP
connections from multiple points in the network.  Since routing
attacks are often localized or dependent on the position of the
attacker, forcing the attacker to attack multiple points (the
server's validation vantage points) or a specific point (the DNS /
HTTP server) makes it more difficult to subvert ACME validation using
attacks on routing.