This message is to solicit opinions about a proposed new ACME challenge to address hosting environments where a user cannot easily prove control using existing methods, but could via an alternative DNS-based approach.
We have observed cases where customers want to restrict DNS changes for most of their domains and delegate the domain control validation through CNAMEs to a centralized location. However, with DNS-01 having a static label, these customers are prevented from being able to use CNAME delegation to integrate with more than one ACME CA for certificate issuance. Being able to have multiple independent instances of an ACME client obtain certificates for the same domain is particularly important for High Availability deployments, where Subscribers often set up multiple independent serving stacks that integrate with multiple ACME CAs for failover and need a valid certificate in each of them. The new challenge is called DNS-ACCOUNT-01 and it extends (but does not replace) DNS-01 in the following way: the DNS label under which the TXT record is created to respond to the challenge is account dependent. This allows a Subscriber to use multiple and separate subdomains to solve ACME challenges for the same domain. We plan to submit this as a draft to the IETF for consideration, to make the challenge available to all CAs and promote its adoption in ACME clients. The current draft is available here: https://daknob.github.io/draft-todo-chariton-dns-account-01/ A text version is available here: https://daknob.github.io/draft-todo-chariton-dns-account-01/draft.txt In DNS-01, the CA checks for DNS records under _acme-challenge. In DNS-ACCOUNT-01, the CA will check for DNS records under _acme-challenge_accountUniqueValue, e.g. _acme-challenge_ujmmovf2vn55tgye. The last part is constructed from base32 encoding a part of the SHA-256 hash of the ACME Account URL. This allows each ACME account to use a separate subdomain for the TXT record. We believe that BR Method 3.2.2.4.7 can be used with the proposed challenge for proof of domain control. We welcome any thoughts you may have on the matter and we will be happy to discuss this and move it forward. -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/393fb427-90f6-4f3d-b82b-db62e47ea5ddn%40mozilla.org.
