Subject: [Acme] Current Charter language

From: Ted Hardie <[email-masked]>
Date: Fri, 15 May 2015 09:48:38 -0700

Okay, with the discussion so far, the charter looks like this:

Automated Certificate Management Environment (ACME)

Historically, issuance of certificates for Internet applications
(e.g., web servers) has involved many manual identity validation steps
by the certification authority (CA).  The ACME WG will specify
conventions for automated X.509 certificate management, including
validation of control over an identifier, certificate issuance,
certificate renewal, and certificate revocation.  The initial focus of
the ACME WG will be on domain name certificates (as used by web
servers), but other uses of certificates can be considered as work
progresses.

ACME certificate management must allow the CA to verify, in an
automated manner, that the party requesting a certificate has authority
over the requested identifiers, including the subject and subject
alternative names.  The processing must also confirm that the requesting
party has access to the private key that corresponds to the public key
that will appear in the certificate.  All of the processing must be done
in a manner that is compatible with common service deployment
environments, such as hosting environments.

ACME certificate management must, in an automated manner, allow an
authorized party to request revocation of a certificate.

The ACME working group is specifying ways to automate certificate
issuance, validation, revocation and renewal.  The ACME working
group is not reviewing or producing certificate policies or
practices.

The starting point for ACME WG discussions shall be draft-barnes-acme.

I think we know of two milestones now, a first draft-ietf and submitting
the protocol draft for proposed standard.  To give dates for those, how
about:

Milestones:

August 2015   Initial working group draft
March 2016    Submit working group to IESG as Proposed Standard

Any other obvious edits needed?

Ted

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 15 May 2015 18:09:48 +0000

> Any other obvious edits needed?

LGTM

--  
Senior Architect, Akamai Technologies
IM: [email-masked] Twitter: RichSalz

---

From: Martin Thomson <[email-masked]>
Date: Fri, 15 May 2015 11:23:49 -0700

>> Any other obvious edits needed?

Shipping is a feature.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 15 May 2015 19:28:08 +0100

>> Any other obvious edits needed?

(no hats)

Me too. I like it and figure it's good enough.

The only thing I'd suggest maybe adding is the illustrative goal
that an "apt-get install apache" should be able to get the required
certificates for a web server automatically, if there is an acme
server that is willing to automate that far. And that a subsequent
"apt-get upgrade" on that box should ensure that the certificate
stuff needed for that apache install gets renewed if necessary.

I can see that it might be tricky to phrase that in language
that works in a charter though, but maybe someone's feeling nicely
creative.

The reason to want this in (for me) is that I think that example
can ground the work and be useful to head off some potential rat
holes that might otherwise crop up. And it captures the by far
most important requirement for acme to meet which is good to keep
in front of us.

Cheers,
S

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
> 
>

---

From: Ted Hardie <[email-masked]>
Date: Fri, 15 May 2015 11:38:45 -0700

On Fri, May 15, 2015 at 11:28 AM, Stephen Farrell <[email-masked]
> wrote:

> that works in a charter though, but maybe someone's feeling nicely
​Well, at the moment we says this:

"All of the processing must be done in a manner that is compatible
with common service deployment environments, such as hosting
environments.​"

Perhaps we can add something just after like this:

"Simplicity in certificate installation and maintenance are
key design goals.  Enabling this process to be incorporated
into the standard installation and upgrades of web servers
via a single command line invocation or flag would be
especially desirable".

That's less catchy than "apt-get install acme-cert", but it
may be more charter-y.

Is that worth doing?

Ted

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 15 May 2015 19:45:34 +0100

On 15/05/15 19:38, Ted Hardie wrote:
> On Fri, May 15, 2015 at 11:28 AM, Stephen Farrell 
> <[email-masked] <mailto:[email-masked]>> wrote:
>
>
>
> ​ Well, at the moment we says this:
>
I like it anyway. I'm fine if you'd prefer to go ahead without
it though,
S.

>     > IM: [email-masked] <mailto:[email-masked]> Twitter: RichSalz
>     > [email-masked] <mailto:[email-masked]>

---

From: Richard Barnes <[email-masked]>
Date: Fri, 15 May 2015 15:20:16 -0400

On Fri, May 15, 2015 at 2:45 PM, Stephen Farrell <[email-masked]>
wrote:

>  On Fri, May 15, 2015 at 11:28 AM, Stephen Farrell <
> [email-masked]> wrote:
>
>>
>>

I like the charter better without it, tbh.  I don't think there's any
ambiguity in what we're after in this dimension :)

---

From: ⌘ Matt Miller <[email-masked]>
Date: Fri, 15 May 2015 13:31:00 -0600

On 5/15/15 1:20 PM, Richard Barnes wrote:
> 
> 
> On Fri, May 15, 2015 at 2:45 PM, Stephen Farrell 
>> that an "apt-get install apache" should be able to get the 
>> required certificates for a web server automatically, if there is
>> an acme server that is willing to automate that far. And that a
>> subsequent "apt-get upgrade" on that box should ensure that the
>> certificate stuff needed for that apache install gets renewed if
>> necessary.
>> 
>> I can see that it might be tricky to phrase that in language that
>> works in a charter though, but maybe someone's feeling nicely 
>> creative.
>> 
>> 
>> "All of the processing must be done in a manner that is
>> compatible with common service deployment environments, such as
>> hosting environments.​"
>> 
>> "Simplicity in certificate installation and maintenance are key
>> design goals.  Enabling this process to be incorporated into the
>> standard installation and upgrades of web servers via a single
>> command line invocation or flag would be especially desirable".
>> 
>> That's less catchy than "apt-get install acme-cert", but it may
>> be more charter-y.
>> 
>> Is that worth doing?
> I like it anyway. I'm fine if you'd prefer to go ahead without it
> though,
> 
> 
> I like the charter better without it, tbh.  I don't think there's
> any ambiguity in what we're after in this dimension :)
> 
> 

I agree with Richard, FWIW.

And +1 on the rest of the existing charter.  SHIPIT.

- -- 
- - m&m

Matt Miller < [email-masked] >
Cisco Systems, Inc.

---

From: [email-masked]
Date: Fri, 15 May 2015 19:43:24 +0000

On Fri May 15 20:31:00 2015 GMT+0100, ⌘ Matt Miller wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 

Fair nuff I can live with(out) it
S

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
> Comment: GPGTools - https://gpgtools.org
> 
> iQEcBAEBCgAGBQJVVkl0AAoJEDWi+S0W7cO1mA4H/R85YcL8VDmICG6ebl/G1tSn
> NksrqJJBBxtsQtw6R2xXWDhJ4QGRPG+Eu3wypQd92uUSb++JwcyF+7B1/pk2gDOO
> jWbVjJLzgYsynegMGLYtAiWmOJKK/Ysz/t6UgrqQAtqh83ShqMFCT/dACKfjIAPR
> JbZN+AsgIyxCx3jzjjebaHszcy4yBQi91CK8dq/Ok8TKuBs/0D4j+faadcg7QO4o
> mtJePv+typLcyWFdE0jg2JxkWSVlVLcjsAWgtMnlTlWCvhaQSyXr9Qlwdp45LptE
> MvcYg9xtzOM1bIp1jg2kqeBoK2V2tvjQTSxfsVG46wGnb/Ow1xB5606Zb1jcTQs=
> =ryWD
> -----END PGP SIGNATURE-----
>

---

From: Randy Bush <[email-masked]>
Date: Fri, 15 May 2015 09:48:27 -1000

i say ship it now before some pedant such as i starts ranting about the
grammar.  e.g.

> but other uses of certificates can be considered as work progresses.

s/can/may/

randy

---

From: Russ Housley <[email-masked]>
Date: Sat, 16 May 2015 12:07:35 -0400

> most important requirement for acme to meet which is good to keep

I would rather ship the charter as it is.

While "apt-get" stuff is very interesting, it is not the only way to implement the protocol.

Russ