Let's Encrypt recently did its first update of its Subscriber Agreement,
and ran into some incompatibility. The current spec makes it seem like
the client should update the registration object whenever the Subscriber
Agreement (known in ACME as terms-of-service) changes.

However, early in drafting LE's Subscriber Agreement, we realized that
if we required human approval of Subscriber Agreement changes, that
would break auto-renewal. So our Subscriber Agreement says that updates
automatically apply to existing users after a notice period.*

The existing ACME terms-of-service flow is an awkward hold-over from
when we treated the new-reg URL as the entry point. Currently you create
an account, get told the ToS URL, and update the account object with
that URL. That then gets stored as a property of the registration object
forever.

Now that we have the directory object, and it contains a
terms-of-service URL, we can say that for CAs with a terms-of-service
URL, you must agree before you can create an account. We can have an
"agree": true field in the new-reg POST to signal agreement to the
current terms-of-service from the directory object. Then the
terms-of-service URL doesn't need to be a permanent part of the
registration object, and we can avoid ambiguity over whether and when
clients need to update or check it.

What do you think?




*As much as I dislike these types of agreement as a consumer, I think
it's the only reasonable approach to allow robust automatic issuance

_______________________________________________
Acme mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/acme

Reply via email to