Hello, Why does ACME use CSRs, rather than having the client submit the relevant details as part of the API? It would seem a lot simpler—and just as useful?—to submit a public key and domain names directly. Thank you!

Yes, CSRs are signed by the private key which corresponds to the public key embedded in the CSR (and which will then be embedded in the final certificate as well). Yes, Let's Encrypt verifies that the signature on the CSR is valid. But, this does not prove that the client/applicant controls that p…

Why does ACME use CSRs?

Issuance Tech

petercooperjr January 3, 2023, 6:32pm 16

Thanks. There is also some talk in that thread about the original discussion here, from one of the original Certbot engineers that they considered not using CSRs but ended up going with it:

4 Likes

Topic		Replies	Views
Some questions about acme-v1 Client dev	8	2006	June 17, 2018
ACME use one key pair in "account key pair" to create multiple CSR domain to CA Let's Encrypt? Issuance Tech	5	4693	February 16, 2016
Signing an existing hosted certificate Issuance Policy	4	2788	August 28, 2015
I wrote a Let's Encrypt certificate agent Client dev	5	1553	October 24, 2016
Understanding RFC8555 authorization Client dev	4	615	July 31, 2023

Why does ACME use CSRs?

Related topics