4 ms·

I'm surprised there is no authorization-certificate-based challenge type for ACME yet. That would make ACME practical to use in microsegmented networks. The cl

I'm surprised there is no authorization-certificate-based challenge type for ACME yet. That would make ACME practical to use in microsegmented networks. The closest thing is maybe described (but not shown) in these posts: https://blog.daknob.net/workload-mtls-with-acme/ https://blog.daknob.net/workload-mtls-with-acme/ https://blog.daknob.net/acme-end-user-client-certificates/ https://blog.daknob.net/acme-end-user-client-certificates/

bigp3t3 2y ago
I'd set that up the second it becomes available if it were a standard protocol. Just went through setting up internal certs on my switches -- it was a chore to say the least! With a Cert Template on our internal CA (windows), at least we can automate things well enough!
- formerly_proven 2y ago
  Yeah it's almost weird it doesn't seem to exist, at least publicly. My megacorp created their own protocol for this purpose (though it might actually predate ACME, I'm not sure), and a bunch of in-house people and suppliers created the necessary middlewares to integrate it into stuff like cert-manager and such (basically everything that needs a TLS certificate and is deployed more than thrice). I imagine many larger companies have very similar things, with the only material difference being different organizational OIDs for the proprietary extension fields (I found it quite cute when I learned that the corp created a very neat subtree beneath its organization OID).
benburkert 2y ago
It's 100% possible today to get certs in segmented networks without a new ACME challenge type: https://anchor.dev/docs/public-certs/acme-relay https://anchor.dev/docs/public-certs/acme-relay (disclamer: i'm a founder at anchor.dev)
- webprofusion 2y ago
  Does your hosted service know the private keys or are they all on the client?
  - benburkert 2y ago
    No, they stay on the client, our service only has access to the CSR. From our docs: > The CSR relayed through Anchor does not contain secret information. Anchor never sees the private key material for your certificates.

bigp3t3 2y ago

I'd set that up the second it becomes available if it were a standard protocol. Just went through setting up internal certs on my switches -- it was a chore to say the least! With a Cert Template on our internal CA (windows), at least we can automate things well enough!

formerly_proven 2y ago
Yeah it's almost weird it doesn't seem to exist, at least publicly. My megacorp created their own protocol for this purpose (though it might actually predate ACME, I'm not sure), and a bunch of in-house people and suppliers created the necessary middlewares to integrate it into stuff like cert-manager and such (basically everything that needs a TLS certificate and is deployed more than thrice). I imagine many larger companies have very similar things, with the only material difference being different organizational OIDs for the proprietary extension fields (I found it quite cute when I learned that the corp created a very neat subtree beneath its organization OID).

benburkert 2y ago

It's 100% possible today to get certs in segmented networks without a new ACME challenge type: https://anchor.dev/docs/public-certs/acme-relay https://anchor.dev/docs/public-certs/acme-relay (disclamer: i'm a founder at anchor.dev)

webprofusion 2y ago
Does your hosted service know the private keys or are they all on the client?
- benburkert 2y ago
  No, they stay on the client, our service only has access to the CSR. From our docs: > The CSR relayed through Anchor does not contain secret information. Anchor never sees the private key material for your certificates.