Re: [Uta] MTA-STS with lots of domains

2019-01-11 Thread Grant Taylor
On 01/11/2019 12:28 PM, John Levine wrote: I use acme.sh which inserts them every time it renews the cert. I haven't looked to see whether the record changes. Everything's automated and the renewals start a while before the cert expires so if it flakes today, it'll work tomorrow which has

Re: [Uta] MTA-STS with lots of domains

2019-01-11 Thread John Levine
In article you write: >> If I could give LE a hint about which NS to look at, the flakiness would >> go away. > >How often do you need to update DNS records for Let's Encrypt? I use acme.sh which inserts them every time it renews the cert. I haven't looked to see whether the record changes.

Re: [Uta] MTA-STS with lots of domains

2019-01-11 Thread Grant Taylor
On 01/11/2019 10:51 AM, John R Levine wrote: In my case the problem is that I swap DNS secondary service with the ISP down the road, and his name servers don't always pick up changes when I poke it. Nice trade. If I could give LE a hint about which NS to look at, the flakiness would go

Re: [Uta] MTA-STS with lots of domains

2019-01-11 Thread John R Levine
On Fri, 11 Jan 2019, Ned Freed wrote: From what I can tell there is no limit that would prevent you from maintaining as many domains as you want, even in the presence of a 2% valiation failure rate - a rate which, if I had it, I would consider unacceptable and would consider fixing it a top

Re: [Uta] MTA-STS with lots of domains

2019-01-11 Thread ned+uta
> In article <01r1svv1718u000...@mauve.mrochek.com> you write: > >Agreed, but to be fair, there is a 500 domain per IP limit with Let's > >Encrypt. > >But 500 is a lot more than 80, and if you're servicing over 500 domains that > >sounds like a fairly commercial enterprise to me, with all that

[Uta] TLS attacks relevant for EAP-TLS

2019-01-11 Thread John Mattsson
Hi, The draft "Using EAP-TLS with TLS 1.3" (draft-ietf-emu-eap-tls13-03) specifies the use of EAP-TLS with TLS 1.3: https://tools.ietf.org/html/draft-ietf-emu-eap-tls13 https://github.com/emu-wg/draft-ietf-emu-eap-tls13 In Bangkok the EMU WG decided to analyse if some of the known attacks on

Re: [Uta] AD review of draft-ietf-uta-smtp-require-tls-06

2019-01-11 Thread Alexey Melnikov
Hi Jim, Below I removed comments where we are in agreement (or which we already discussing separately). I will reply to a few remaining comments separately. On 10/01/2019 19:48, Jim Fenton wrote: Thanks for your review, Alexey. Responses and a few clarifying questions below. On 1/9/19 8:34

Re: [Uta] AD review of draft-ietf-uta-smtp-require-tls-06

2019-01-11 Thread Alexey Melnikov
Hi Jim, Very quick comment on just one point: On 10/01/2019 19:48, Jim Fenton wrote: Examples/ABNF, I had thought this was simple enough that these weren't needed, but fair point, will add. For new header fields it is important to show whether any CFWS are allowed in values, so I prefer