One possibility would to make it the client's responsibility to request EV by including the desired O, OU, etc. fields in the Subject DN of the CSR. It would then be the server's responsibility to accept or reject the request based on whether the account has a sufficient validation level (and payment).
One of the big open questions in ACME is how paid CAs will manage the connection between existing accounts and accounts as defined by ACME. It sounds like that's a need you're likely to have. Do you have any particular ideas about how you'd like to manage it? On 08/15/2016 08:53 AM, J.C. Jones wrote: > Hi Andy, > > I'm not sure I follow exactly what the format of this token would be, > or what message(s) in the protocol you'd like to add it to. Perhaps > you can make some specific recommendations - even if they're tentative > examples - for the WG to look at and reason through? > > Thanks! > J.C. > > On Sun, Aug 14, 2016 at 9:10 PM, Andy Ligg <[email protected] > <mailto:[email protected]>> wrote: > > Hi all, > > StartCom plan to use ACME protocol for StartEncrypt, we need to > identify the client's validation level, so the subscriber > administration can generate a special token in the StartSSL.com > account that send this token to the email address used in the ACME > registration. > > At the registration, user need to enter email and this token with > the certificate to let the CA system know this customer's > validation level. > After the CA system receive the email, the token and signing > certificate, CA system know what type of certificate we can issue > to this client; if this client account is class 4 validated, then > the client can get EV SSL certificate, not DV SSL. > please add this a parameter to the ACME protocol, thanks. > > Best Regards, > > Andy Ligg > StartCom > _______________________________________________ > Acme mailing list > [email protected] <mailto:[email protected]> > https://www.ietf.org/mailman/listinfo/acme > <https://www.ietf.org/mailman/listinfo/acme> > > > > > _______________________________________________ > Acme mailing list > [email protected] > https://www.ietf.org/mailman/listinfo/acme
_______________________________________________ Acme mailing list [email protected] https://www.ietf.org/mailman/listinfo/acme
