3 ms·
ACME seems so overcomplicated. How about just making the domain owner publish which certs are valid on a url like /certificates.txt Then LetsEncrypt could per
by TekMol 9y ago
ACME seems so overcomplicated.
How about just making the domain owner publish which certs are valid on a url like /certificates.txt
Then LetsEncrypt could periodically check if the certs they issued are still endorsed by the domain owner. And if not revoke them.
- gruez 9y ago>And if not revoke them. Certificate revocation is not guaranteed. Yes, there's CRLs and OSCP, but there are plenty of clients that don't do either of those. Not to mention how big CRLs will get if certificates can be issued and revoked for free.
- zaarn 9y agoAccess to this /certificates.txt would need to be done over a TLS connection as an attacker could insert their own certs here. ACME avoids this by associating a specific CSR to a response, so an attacker could not insert their own certificate in the middle of the process and get it signed.