CanSignHttpExchanges extension

Feature Requests
1

Signed HTTP Exchanges require SSL certificates with the CanSignHttpExchanges extension. DigiCert is currently the only provider of these certificates. It would be wonderful if support for this extension could be incorporated into Let’s Encrypt certificate generation.

References:
Signed HTTP Exchanges (jump to certificate requirements)
Signed HTTP Exchanges Implementation Checkpoints
Reference implementation of Signed HTTP Exchanges format generator
Google write-up about HTTP Signed Exchanges
DigiCert with CanSignHttpExchanges extension

2 Likes
2

Hi @mdmower,

Welcome to the Let's Encrypt community forum :wave:

I haven't been following any of this Signed HTTP Exchanges work. Thanks for opening a thread and sharing some context.

I think it's likely too early in this draft's development for Let's Encrypt to prioritize implementation. It looks like it has a ways to go within the IETF before it would be an internet standard.

Beyond the x.509 extension draft-yasskin-http-origin-signed-responses section 4.2 "Certificate Requirements" mentions:

A conforming CA MUST NOT issue certificates with this extension unless, for each dNSName in the subjectAltName extension of the certificate to be issued:

  1. An “issue” or “issuewild” CAA property ([RFC6844]) exists that authorizes the CA to issue the certificate; and
  2. The “cansignhttpexchanges” parameter (Section 4.2.1) is present on the property and is equal to “yes”

Part #2 of this would require development work in Boulder to process the "cansignhttpexchanges" CAA property that the draft introduces.

3 Likes
3

A certificate with the CanSignHttpExchanges extension is required to serve AMP using Signed Exchanges:

https://amp.dev/documentation/guides-and-tutorials/optimize-and-measure/signed-exchange

“As of April 2019, only DigiCert provides this extension.”

1 Like
4

Is this something to implement (instead of something like S/MIME!) whilst browser vendors officially consider the spec harmful?

5

Thanks for providing some context. Many of the comments you’ve shared are outdated though (by over a year). Notably, in the first thread you linked, there is ongoing effort to assuage the standards-positions concerns; see https://github.com/mozilla/standards-positions/issues/29#issuecomment-459547918 .

6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.