So while implementing revocation in my ACME client, I came to the following problem: how do you know which ACME server issued a certificate?
Given an ACME server URL, one can obtain a certificate, but there is no reliable way to do the reverse. If you think about it, it might be desirable to be able to revoke a certificate possessing nothing but the certificate. For example, suppose you identify a misissued certificate for a domain you control. Under the current ACME protocol, if you can prove control of that domain, you can revoke the certificate; however, this requires you to know what server issued it. Not sure what the good solutions to this are. One would be to include the directory URL as an X.509 or OCSP extension, though that bloats the certificate/response. Another might be to reuse the OCSP responder URL, so that given an OCSP endpoint, one can obtain the ACME server URL, or at least one suitable for revocation. Something like: Normal OCSP Request: GET http://ocsp.example.com/ocsp/MFMwUTBPME0wSzAJ Revocation Location OCSP Request: GET http://ocsp.example.com/ocsp/acme-revoker/MFMwUTBPME0wSzAJ 302 Found Location: https://acme-staging.letsencrypt.org/directory Thoughts? Hugo Landau _______________________________________________ Acme mailing list [email protected] https://www.ietf.org/mailman/listinfo/acme
