[{"author": "Mike Ounsworth", "text": "

How does ACME get the giant room while LAMPS has been standing-room-only for many IETFs in a row?

", "time": "2025-03-20T06:08:16Z"}, {"author": "Deb Cooley", "text": "

acme is special

", "time": "2025-03-20T06:08:38Z"}, {"author": "Yoav Nir", "text": "

Traditionally we got the good rooms by also getting the worst slots - last slot on Friday. Then we started getting better time slots, but we still get the good rooms

", "time": "2025-03-20T06:12:06Z"}, {"author": "Phillip Hallam-Baker", "text": "

Yes, it is an operational summary. But those are useful.

", "time": "2025-03-20T06:29:31Z"}, {"author": "Phillip Hallam-Baker", "text": "

@Mike, ACME needs the larger room because the Roadrunner sometimes takes deliveries

", "time": "2025-03-20T06:32:21Z"}, {"author": "Corey Bonnell", "text": "

https://github.com/joohoi/acme-dns

", "time": "2025-03-20T06:33:38Z"}, {"author": "Henry Birge-Lee", "text": "

^ Regarding ACME DNS, it would be good to standardize something. I am curious about the pros and cons of just a standardized REST/JSON API for updating ACME challenges vs using DNS UPDATE.

", "time": "2025-03-20T06:38:24Z"}, {"author": "Yoav Nir", "text": "

@meetecho: Please pan to the speaker

", "time": "2025-03-20T06:42:29Z"}, {"author": "Henry Birge-Lee", "text": "

https://github.com/slghtr-says/servercert/pull/3 For those who are interested, this is Michael Slaughter's proposed ballot at the CA/B Forum that would no longer require a dynamic DNS change for DNS challenges. Obviously this technique would have to be adopted in ACME, but if it is permissible in the webPKI, it could potentially be considered for other PKI use cases as well.

", "time": "2025-03-20T06:45:02Z"}, {"author": "Li Ruochen", "text": "

Henry Birge-Lee said:

\n
\n

^ Regarding ACME DNS, it would be good to standardize something. I am curious about the pros and cons of just a standardized REST/JSON API for updating ACME challenges vs using DNS UPDATE.

\n
\n

Agree that it may be helpful to standardize a simple REST API for dns update. Not sure if it should be acme specific or generic (a complete REST version of DNS UPDATE).

", "time": "2025-03-20T06:53:40Z"}, {"author": "Phillip Hallam-Baker", "text": "

In my architecture, a device being provisioned talks to an onboarding service via a JSON protocol which it uses to specify all the things it needs to function: A DNS name but not which exact name, Inbound port mappings, DNS service publication, WebPKI credential.

\n

Then the service works out HOW to deliver these.

", "time": "2025-03-20T07:00:26Z"}, {"author": "Phillip Hallam-Baker", "text": "

This approach means that the pieces that are integration to site specific infrastructure are isolated from the device

", "time": "2025-03-20T07:00:54Z"}, {"author": "Mike Ounsworth", "text": "

Hmm. So the security model here is that the ACME client is malicious?

", "time": "2025-03-20T07:08:36Z"}, {"author": "Deb Cooley", "text": "

that's what it looks like

", "time": "2025-03-20T07:08:55Z"}, {"author": "Chunchi Liu", "text": "

ACME client is malicious ==> _could be compromised_

", "time": "2025-03-20T07:09:30Z"}, {"author": "Mike Ounsworth", "text": "

My intuition tells me that that's an un-solvable problem, though I have not yet studied this proposed solution.

", "time": "2025-03-20T07:09:49Z"}, {"author": "Yoav Nir", "text": "

Is a compromised client something we can even protect against? It's the endpoint

", "time": "2025-03-20T07:10:16Z"}, {"author": "Aaron Gable", "text": "

Agreed -- if the client can substitute the pubkey in the Finalize request, it can also substitute the pubkey identifier in the New Order request.

", "time": "2025-03-20T07:10:22Z"}, {"author": "Yoav Nir", "text": "

I usually think of the ACME client as integrated with the web server. So if you compromise the ACME client, you might as well have compromised the entire web server

", "time": "2025-03-20T07:13:24Z"}, {"author": "Mike Ounsworth", "text": "

Certainly the ACME client needs administrative control to push to DNS and / or HTTP server. It is very powerful. If compromised, then many other bad things happen :/

", "time": "2025-03-20T07:15:01Z"}, {"author": "Bob Beck", "text": "

upload pem file doesn't die with 45 day certs

", "time": "2025-03-20T07:27:56Z"}, {"author": "Bob Beck", "text": "

it just dies more often than it does today

", "time": "2025-03-20T07:28:03Z"}]