I am trying to integrate ACME V2 for a commercial CA, but the CA requires CSR first, then do domain auth, which is conflicting with ACME defined. My question is: Why ACME requires Authz before CSR submitting(finalize)? In another word: Why CSR first does not making sense? Modifying CA’s author…

If I remember correctly, this order was intentionally changed between ACMEv1 (the pre-standardization draft version) and ACMEv2 (the standardized version), so probably there is a history of discussion about this issue and the rationale for it in the IETF process. (If so, that would also make it hard…

I think a lot of the discussion happened off-of this one thread: https://www.mail-archive.com/acme@ietf.org/msg01994.html It looked like it forked and was also linked to a discussion about proactive issuance so it may be a little tricky to follow.

[image] schoen: (If so, that would also make it harder to change in the future, because the current version represents an intentional decision after a debate.) Yes, to be clear LE / myself specifically wanted this protocol flow. I would not be supportive of implementing anything else at Let's…

In that case conceivably ACME could be extended to support another option for other CA adopters, but it might be very difficult in terms of client compatibility because, by default, ACME client software would not understand how to use that extension. It would probably be a lot of work to get client-…

[image] schoen: @jsha , do you happen to have a reference to when or how this discussion occurred? Thanks to @cpu for the link! As @Phil mentioned, we specifically introduced this flow because we wanted to minimize the amount of state required for abandoned orders. I believe that at the time …

But I think it would be a problem, Original CA seems have the capability to implement, just need to re-audit after it. Reseller can’t until CA support CSR-last. Why we need to think about reseller? There’re some certificate authorities haven’t update their infrastructure softwares for decades, Th…

[image] xiaohuilam: There're some certificate authorities haven't update their infrastructure softwares for decades, Their only hope to get ACME supports seems that maybe some 3rd helpful reseller build it for them. That is more a argument to detrust them because they lost the capability to r…

[image] bfqTudaffO1LNwUSmNFf: That is more a argument to detrust them because they lost the capability to react to security threats, than a valid argument for a protocol change request. How about resellers?

That’s a good point! It does seem like it’s hard to fully implement ACME at the reseller level, without support from the CA. Here’s a thought: Does your CA partner keep validation information around for a certain amount of time? Could you submit a dummy CSR in order to trigger validation, then thro…

[image] jsha: Here’s a thought: Does your CA partner keep validation information around for a certain amount of time? Could you submit a dummy CSR in order to trigger validation, then throw away the results, and perform real issuance using an ACME CSR? Note that you would need to be sure that th…

Why ACME requires domain auth first before CSR?

Issuance Tech

tdelmas July 28, 2019, 9:51am 28

No. Not everybody wants to use the services of a company under U.S. jurisdiction. Not everybody can. Diversity is important.

According to mcclatchydc.com Let's Encrypt revoqued and banned USAReally.com - #5 by mkwm
GitHub has blocked an Iranian software developer's account | Packt Hub
https://github.com/tdelmas/Let-s-Clone/blob/master/WHY.md

Topic		Replies	Views
How to provide CSR and verify identity without HTTPS? Help	45	2216	October 5, 2020
[Suggestion] Let's Encrypt operated, TXT-only DNS Hosting for DNS challenges Feature Requests	19	8839	February 14, 2018
Free ACME CA feature comparison Client dev	39	4344	April 7, 2025
Let's Encrypt, ACME challenges, and ExtKeyUsage=ClientAuth Issuance Policy	15	2075	August 7, 2023
Some questions about acme-v1 Client dev	8	2059	June 17, 2018

Why ACME requires domain auth first before CSR?

Related topics