Draft: draft-ietf-acme-acme

Commentary: As pointed out by on the ACME mailing list there are a few places where there was some potential ambiguity about what " server " meant . This PR is the result of a once - through pass looking for places where we could be more specific when saying " server " . In most cases the default definition of " server " from the Terminology section applied and no change was made . I attempted to clarify any usage of " server " that was n't qualified sufficiently to differentiate from the ACME server .
Paragraph (version A):
The guiding use case for ACME is obtaining certificates for Web sites
(HTTPS RFC2818).  In this case, the user's web server is intended to
speak for one or more domains, and the process of certificate
issuance is intended to verify that this server actually speaks for
the domain(s).
Paragraph (version B):
The guiding use case for ACME is obtaining certificates for Web sites
(HTTPS RFC2818).  In this case, the user's web server is intended to
speak for one or more domains, and the process of certificate
issuance is intended to verify that this web server actually speaks
for the domain(s).
Paragraph (version A):
The ACME client periodically contacts the CA to get updated
certificates, stapled OCSP responses, or whatever else would be
required to keep the server functional and its credentials up-to-
date.
Paragraph (version B):
The ACME client periodically contacts the CA to get updated
certificates, stapled OCSP responses, or whatever else would be
required to keep the web server functional and its credentials up-
to-date.
Paragraph (version A):
The order process described above presumes that authorization objects
are created reactively, in response to a certificate order.  Some
servers may also wish to enable clients to obtain authorization for
an identifier proactively, outside of the context of a specific
issuance.  For example, a client hosting virtual servers for a
collection of names might wish to obtain authorization before any
servers are created, and only create a certificate when a server
starts up.
Paragraph (version B):
The order process described above presumes that authorization objects
are created reactively, in response to a certificate order.  Some
servers may also wish to enable clients to obtain authorization for
an identifier proactively, outside of the context of a specific
issuance.  For example, a client hosting virtual servers for a
collection of names might wish to obtain authorization before any
virtual servers are created, and only create a certificate when a
virtual server starts up.
Paragraph (version A):
Dereference the URI using an HTTP GET request.  This request MUST
be sent to TCP port 80 on the server.
Paragraph (version A):
Verify that key authorization provided by the server matches the
token for this challenge and the client's account key.
Paragraph (version B):
Dereference the URI using an HTTP GET request.  This request MUST
be sent to TCP port 80 on the HTTP server.
Paragraph (version B):
Verify that key authorization provided by the HTTP server matches
the token for this challenge and the client's account key.
Paragraph (version A):
The TLS with Server Name Indication (TLS SNI) validation method
proves control over a domain name by requiring the client to
configure a TLS server referenced by the DNS A and AAAA resource
records under the domain name to respond to specific connection
attempts utilizing the Server Name Indication extension RFC6066.  The
server verifies the client's challenge by accessing the reconfigured
server and verifying a particular challenge certificate is presented.
Paragraph (version B):
The TLS with Server Name Indication (TLS SNI) validation method
proves control over a domain name by requiring the client to
configure a TLS server referenced by the DNS A and AAAA resource
records under the domain name to respond to specific connection
attempts utilizing the Server Name Indication extension RFC6066.  The
server verifies the client's challenge by accessing the reconfigured
TLS server and verifying a particular challenge certificate is
presented.
Paragraph (version A):
Open a TLS connection to the domain name being validated,
presenting SAN A in the SNI field.  This connection MUST be sent
to TCP port 443 on the server.  In the ClientHello initiating the
TLS handshake, the server MUST include a server_name extension
(i.e., SNI) containing SAN A.  The server SHOULD ensure that it
does not reveal SAN B in any way when making the TLS connection,
such that the presentation of SAN B in the returned certificate
proves association with the client.
Paragraph (version B):
Open a TLS connection to the domain name being validated,
presenting SAN A in the SNI field.  This connection MUST be sent
to TCP port 443 on the TLS server.  In the ClientHello initiating
the TLS handshake, the server MUST include a server_name extension
(i.e., SNI) containing SAN A.  The server SHOULD ensure that it
does not reveal SAN B in any way when making the TLS connection,
such that the presentation of SAN B in the returned certificate
proves association with the client.
Paragraph (version A):
There are several ways that these assumptions can be violated, both
by misconfiguration and by attack.  For example, on a web server that
allows non-administrative users to write to .well-known, any user can
claim to own the server's hostname by responding to an HTTP
challenge, and likewise for TLS configuration and TLS SNI.
Paragraph (version B):
There are several ways that these assumptions can be violated, both
by misconfiguration and by attack.  For example, on a web server that
allows non-administrative users to write to .well-known, any user can
claim to own the web server's hostname by responding to an HTTP
challenge, and likewise for TLS configuration and TLS SNI.
Paragraph (version A):
An active attacker on the validation channel can subvert the ACME
process, by performing normal ACME transactions and providing a
validation response for his own account key.  The risks due to
hosting providers noted above are a particular case.  For identifiers
where the server already has some public key associated with the
domain this attack can be prevented by requiring the client to prove
control of the corresponding private key.
Paragraph (version B):
An active attacker on the validation channel can subvert the ACME
process, by performing normal ACME transactions and providing a
validation response for his own account key.  The risks due to
hosting providers noted above are a particular case.  For identifiers
where a web server already has some public key associated with the
domain this attack can be prevented by requiring the client to prove
control of the corresponding private key.