acme-spec

What verification strategy are they using to determine when a wildcard cert can be created? I see the discussion on https://github.com/letsencrypt/acme-spec/issues/64 suggesting that they validate a sampling of randomly-generated subdomains, but it's unclear if that's actually the strategy they're using (and an obvious downside with that strategy is it won't work for a client that wants a wildcard cert for whatever reason but hasn't configured DNS to handle arbitrary subdomains, though you could of course argue that these clients don't actually need wildcard certs).

Some of the original discussion is here: https://github.com/letsencrypt/acme-spec/issues/64

> Why wouldn't it check all of them? If I request a certificate for "* .github.com", how do you propose that Let's Encrypt check all of the infinitely-many possible subdomains? > Why would requesting a wildcard for a subdomain (i.e. pas.github.com) give me a cert that works for the root domain (i.e. github.com)? The issue here is that it's only safe to issue a wildcard certificate to someone who already has full control over all of the domains covered by the wildcard, now and in the future. This is impossible to prove using only an HTTP challenge-response. For example, let's say an attacker requests a wildcard certificate for "* .github.io". Hypothetically, LE could say: "OK, to prove that you control all possible subdomains, place a particular nonce at http://e9cd20b9c359939c.github.io/.well-known/acme-challenge... Our attacker quickly r

> here's not even a hint that their system works in OSes other than Linux. > And there's absolutely nothing there to suggest it supports Windows/IIS. Their "system" is an API for issuing certificates. There's nothing platform specific about that. > right now the website conflates the two badly. From https://letsencrypt.org/getting-started/: You’re welcome to use any compatible client, but we only provide instructions for using the client that we provide. Edit: This is the protocol they use: https://github.com/letsencrypt/acme-spec I found the link here: https://letsencrypt.org/how-it-works/

It was named after the protocol: https://github.com/letsencrypt/acme-spec

According to this comment, [0] it looks like wildcard certs haven't been ruled out, but have been deferred due to rather thorny issues regarding getting automated validation right. [0] https://github.com/letsencrypt/acme-spec/pull/97#issuecommen...

That's the relatively simple case, but there are a number of corner cases that make the process much more complicated. See https://github.com/letsencrypt/acme-spec/pull/97 for a discussion of why this was scraped from the ACME specification proposal.

I'm suuuper excited for this to launch! However, it's worrisome that the ACME protocol (what Let's Encrypt uses) still has a ton of bugs open[1] and they are still changing the protocol often. Just search for "TODO" on the spec markdown[2]. I want this project to proceed, but they should really focus on getting a much more mature and stable spec before launch. This isn't WebRTC, where you can just continuously tack on additional stuff or change the API constantly. It's TLS certs. The certs issued using this API end up telling people it's safe to input their passwords or credit card numbers. I really hope the ACME spec gets stable before the launch in July. [1]: https://github.com/letsencrypt/acme-spec/issues [2]: https://github.com/letsencrypt/acme-spec/blob/master/draft-b...

There is an issue on that: https://github.com/letsencrypt/acme-spec/issues/131

There is an open protocol[1] on how to retrieve the certificates, so you can implement a client in a language of your choice, or wait until someone else does it. [1]: https://github.com/letsencrypt/acme-spec

Yes, we plan to apply a few mitigations of this type. Part of the idea of the "Proof of Possession of a Prior Key" challenge is so that if a web server requests a cert for a domain with an existing certificate, we can ask them to prove that they hold that certificate. https://github.com/letsencrypt/acme-spec/blob/master/draft-b...

Looking at the spec [0] I'm concerned about the section on 'Recovery Tokens'. "A recovery token is a fallback authentication mechanism. In the event that a client loses all other state, including authorized key pairs and key pairs bound to certificates, the client can use the recovery token to prove that it was previously authorized for the identifier in question. This mechanism is necessary because once an ACME server has issued an Authorization Key for a given identifier, that identifier enters a higher-security state, at least with respect the ACME server. That state exists to protect against attacks such as DNS hijacking and router compromise which tend to inherently defeat all forms of Domain Validation. So once a domain has begun using ACME, new DV-only authorization will not be performed without proof of continuity via possession o

from the ACME spec, it looks like proof of ownership is provided via[0]: >Put a CA-provided challenge at a specific place on the web server or > Put a CA-provided challenge at a DNS location corresponding to the target domain. Since the server will presumably be plaintext at that point and DNS is UDP, couldn't an attacker like NSA just mitm the proof-of-site-ownership functionality of lets-encrypt to capture ownership at TOFU and then silently re-use it, e.g. via Akamai's infrastructure? [0] https://github.com/letsencrypt/acme-spec/blob/master/draft-b...