The only info on LetsEncrypt's nonce implementation I've found is here: Nonce expiration
I can't find information on other providers
Does anyone have an idea of the following:
The RFC leaves nonce implementation up to servers, and I'm not using nonce-headers as aggressively as I should so I'd like to correct this.
I'm not aware of any providers -- us included -- sharing explicit answers to either of your questions.
That said, there's an easy way to answer your second question for any given provider: see if they provide a Replay-Nonce header alongside their Directory resource. For example, https://dv.acme-v02.api.pki.goog/directory comes with a Replay-Nonce header. Since that's an unauthenticated GET request, the nonce cannot possibly be bound to an account.
That is right. However, independently of that a nonce provided in the header of an answer for an authenticated request might be bound to the account making the authenticated request.
An ACME client service that is multiplexing requests from different accounts and treating the nonce global might terribly fail when connecting such ACME server. Who is the culprit, then?
So I tend to see the way that the RFC must be precise about the scope of a nonce.
There was a nonce related issue long time ago. A client intermixing the connections over IPv4 and IPv6 went to different data centers of Let'sencrypt. The scope of the nonce was per data center:
I've built systems that do exactly that, so always assume others may be doing the same.
isn't there few things that need a nonce outside of account context? (create new account/revoke by private key for example) I don't think ACME server can use account specific nonce:
that's a good point. i can locally cache both a global and per-account nonce.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.