Skip to main content

Auto-discovery mechanism for ACME servers
draft-vanbrouwershaven-acme-auto-discovery-03

Document Type Expired Internet-Draft (individual)
Expired & archived
Authors Paul van Brouwershaven , Mike Ounsworth , Corey Bonnell , Iñigo Barreira , Q Misell
Last updated 2024-08-18 (Latest revision 2024-02-15)
RFC stream (None)
Intended RFC status (None)
Formats
Additional resources GitHub Repository
Related Implementations
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:

Abstract

A significant impediment to the widespread adoption of the Automated Certificate Management Environment (ACME) [RFC8555] is that ACME clients need to be pre-configured with the URL of the ACME server to be used. This often leaves domain owners at the mercy of their hosting provider as to which Certification Authorities (CAs) can be used. This specification provides a mechanism to bootstrap ACME client configuration from a domain's DNS CAA Resource Record [RFC8659], thus giving control of which CA(s) to use back to the domain owner. Specifically, this document specifies two new extensions to the DNS CAA Resource Record: the "discovery" and "priority" parameters. Additionally, it registers the URI "/.well-known/acme" at which all compliant ACME servers will host their ACME directory object. By retrieving instructions for the ACME client from the authorized CA(s), this mechanism allows for the domain owner to configure multiple CAs in either load-balanced or fallback prioritizations which improves user preferences and increases diversity in certificate issuers.

Authors

Paul van Brouwershaven
Mike Ounsworth
Corey Bonnell
Iñigo Barreira
Q Misell

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)