It seems that there are potentially multiple valid sets of authorizations that are mutually exclusive.
Consider a request for a certificate that has three SANs: a.example.com, b.example.com, c.example.com There are two valid paths to issuance: validate example.com, or validate the three SANs as specified in the CSR. Under the precondition system, with ACME server/client implementations that were aware of this shortcut, the client could present a CSR that included example.com as one of the SANs, the server would return a single authorization request for example.com, and then after fulfilling that request, a subsequent request could be made with a CSR that did not contain the example.com SAN, only the subdomains, which would lead to immediate issuance without further authorization. Does it make sense for the server to be allowed to return multiple exclusive sets of authorizations that could lead to issuance, in order to avoid knowledge of the issuance rules in the client? Jonathan _______________________________________________ Acme mailing list [email protected] https://www.ietf.org/mailman/listinfo/acme
