So, seeing that the recent incident utilized updating ARI to tell affected people to renew prematurely, even though I wasn't affected it inspired me to take some time this weekend and finally play around with getting the data. At this point all I did was make a script to try to get the information;…

[image] orangepizza: ARI doesn't talk about what account it requested by. Most clients manage the "account" internally and this is not likely to change but I have thought about that. You could use openssl to check the public key of the certificate signing request against the certificate, but…

[image] orangepizza: ARI doesn't talk about what account it requested by. You can check this with openssl or by comparing the public keys some other way, eg. # Step 1: Extract public key from CSR openssl req -in your_csr_file.csr -noout -pubkey -out public_key.pem # Step 2: Extract public k…

that's about certificate's key, certificate doesn't say what acme account was requested it

[Screenshot 2024-12-12 201407] take this example, one set is your "account" and the other set is the keys you signed the CSR with, you should keep track of which "account" used which "signing keys" so you can connect the dots so to speak. I agree with you, maybe some kind of thumbprint could be a…

To me, those are really weird names..

[image] aarongable: In the WebPKI, that extension should only ever have the keyIdentifier field, but thorough/defensive programming is always valuable. I've done some testing and figured I'd circle back on this for the benefit of others. First, I constructed an edge-case cert, attached, that…

[image] jvanasco: The Python crypto library requires BOTH to be present when constructing a cert; I'm not sure if that is RFC compliant or not. Yes, the way the AuthorityKeyIdentifier extension works is that you either present a keyIdentifier, or you present both a authorityCertIssuer and an …

[image] jvanasco: First, I constructed an edge-case cert, authorityKeyIdentifier field has the OID of 2.5.29.35 so long as you extract by OID you should always get the correct value Here is an example of how to reliably extract the AKI from a certificate that has been turned into a buffer e…

Oh, I see what you are saying now, maybe I need to change this a bit. It is probably quite common to use python.

Thoughts from starting to play with ARI

Client dev

jvanasco December 12, 2024, 2:32pm 98

One can track a SPKI Hash to quickly cross-reference all these related keys and applications.

AccountKey and PrivateKey SPKIs are for the key itself.
CSR and Cert SPKIs are for the PrivateKey.

Topic		Replies	Views
Can ARI-conforming clients be granted exemptions to relevant rate limits? Client dev	47	2888	May 11, 2023
Client Burden of Preemptive ARI Timing Selection Client dev	20	533	July 29, 2025
ARI recommendation may cause renewal outside Suggested Window Client dev	42	736	April 18, 2025
Implemented HTTP-01 with ARI Extension in Javascript Client dev	3	207	January 13, 2025
What are you doing with ARI Retry-After? Client dev	28	660	March 6, 2025

Thoughts from starting to play with ARI

Related topics