On Friday, 1 July 2016 20:44:00 UTC+1, Peter Kurrasch wrote: > Only reason I'm focusing on Let's Encrypt and ACME is because they are > currently under review for inclusion. As far as I'm concerned all CA's with > similar interfaces warrant this extra scrutiny. > > I am somewhat curious if any of this has come up before in other forums--that > these interfaces can be abused and lead to certificate mis-issuance?
As I understand it StartCom sprang their protocol and its implementation, which are proprietary and very thinly documented, as a surprise from first announcement to general availability in a day or less - presumably for commercial advantage. I'm not aware of - and suspect there hasn't been any - independent analysis of their system. ACME is a protocol intended to become an IETF Standards Track RFC. You are welcome to read the existing discussions of the protocol, or to participate (subject to usual IETF rules) https://www.ietf.org/mailman/listinfo/acme. As with Mozilla's inclusion process the IETF process ends up partly being a test of endurance, as even simple ideas are dragged out over several months with posts that have some technical meat being mixed in with axe-grinding and larger politics. Let's Encrypt's implementation of ACME, Boulder, is on github for anyone to inspect. I am not aware of any independent formal analysis, but it's obvious from the contributions to Boulder that people outside Let's Encrypt do look at it. _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
