namedrop-protocol-spec

IP certs improve a niche but interesting use case for me. I run a domain registrar that implements a simple OAuth2 protocol[0] for delegating domains/subdomains. I also have an open source tunneling tool called boringproxy that implements the client side of this protocol[1]. boringproxy needs to provide a callback redirect_uri to the oauth server in order to retrieve it's token, which it can then use for setting DNS records. However, it can't provide an HTTPS endpoint until it can set up those DNS records and get a cert. Chicken/egg. Currently the spec requires the server to implement a `GET /temp-domain` endpoint which creates a DNS record like 157-245-231-242.example.com which points at the client's IP. This lets boringproxy bootstrap a secure OAuth2 callback endpoint. IP certs would remove an entire step from this process. [0]: https:/

There's the DomainConnect protocol[0] which has been around for a few years. I didn't find it particularly well matched for open source projects, so I've also done some work on my own protocol[1]. The current draft is implemented by TakingNames.io (as a provider) and boringproxy (as a client). You can read more about it and watch a demo here[2]. That said, I think DNS might not be the right layer of abstraction to simplify this. I think we need an open tunneling protocol[3]. [0]: https://www.domainconnect.org/ [1]: https://github.com/takingnames/namedrop-protocol-spec [2]: https://takingnames.io/blog/introducing-takingnames-io [3]: https://forum.indiebits.io/t/toward-an-open-tunneling-protoc...