Will PoP become mandatory for authorization renewals?


#1

After reading ACME specs, some community topics here and also Boulder’s issues tracker, I have one question remaining…

Let’s present the context first:

An account key pair is registered and authorized (for 10 months) for domain example.com. There have been 4 certificates that have been issued during these 10 months.
For the next certificate renewal, the authorization for that account key pair is expired. So the client performs a new authorization request for example.com.

The question is (well… are): will PoP be mandatory beside DV challenges to perform the authorization? Shouldn’t DV challenges be enough? And what if the subject keys are lost?

It is interesting to notice that if certificates are revoked, Boulder wouldn’t ask any PoP (#660 Boulder issues tracker).

Cheers,


#2

whats pop? if I may ask


#3

POP = Proof of Possession
This mean you prove that you have access to something.
I this case the old cert private key.


#4

well in this case I dont hope it becomes mandatory, I mean what happens if you buy a domain from someone who used LE in the past?, there wont be any POP possible for that.


#5

You will find details on this validation method here.

And the issuance policy there. As you can see, ACME specs say:

  • Domain with a cert from this CA, lost account key: DV + PoP of ACME-certified Subject key

On the other hand, ACME specs say that server MAY use different sets of challenge and present the previous combination as an example. What does Let’s Encrypt plan to do with its issuance policy once PoP is implemented?


#6

well so according to the specs the pop gets only needed when acc key is lost but as I said if you transfer a domain that has a still valid LE cert (e.g. sell it) the next owner has neither account nor prev cert key, therefore this PoP is seriously annoying in that case.


#7

I picked the wrong line from the specs, sorry:

  • Domain for which known certs exist from other CAs: DV + Proof of Possession of
    previous CA-signed key

In this case, we didn’t lose the account key but we are required to perform a PoP if another CA (or even Let’s Encrypt CA, depending on choices and implementation) issued a certificate for that domain.


#8

but still if a domain gets transferred to another entity you wont have the old cert.


#9

Yes that’s why I would like to know what will be Let’s Encrypt policy regarding PoP once is implemented.


#10

well I hope not and whoever wrote it in the acme specs is either insane or just forgot that.
my opinion would be that a snapshot of some important parts of the whois is taken and if it is not evident that the owner hasnt changed (e.g. if the whois changed) then in my opinion PoP MIUST be abandoned.


#11

This validation method (PoP) seems to go against the willingness to encrypt the whole web. Shouldn’t DV for authorizations and Recovery for lost Account keys be sufficient methods?

However I’m not sure that relying on whois informations is consistent for automated certificates issuances (@My1).


#12

I dont say that it is relying on that but the descision on whether pop should be even considered could be done using the whois.
no change=CA decides
change= no PoP, never


#13

You also have the problem if you lose your data on disk. Three cases:

  • You recover your account and authorizations: you can perform PoP if you issued a certificate after recovery and before authorization’s expiration. Otherwise you can not perform PoP.

  • You recover your account but it’s not authorized anymore : you can not perform PoP.

  • You register a new key and request authorization for your domain name: you can not perform PoP.