Subject: [Acme] Remove combinations array

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 17 Aug 2016 11:22:47 -0700

https://github.com/ietf-wg-acme/acme/pull/171

This is a fairly complicated part of the protocol, and not used in
practice. For instance, in Let's Encrypt's implementation, there are
always three challenges, any one of which may be fulfilled by the client.

After this change, all challenges are considered to be combined with an
"OR." That is, any challenge within an authorization may be completed to
make the authorization valid.

Authorizations within the new-application object are considered to be
combined with an "AND." That is, all of them must become valid before
the certificate will be issued. The combination of the two means that we
have similar expressiveness as before, even without the combinations array.

Thoughts?

---

From: Richard Barnes <[email-masked]>
Date: Wed, 17 Aug 2016 15:41:56 -0400

SGTM.  I never like "combinations" much anyway :)  I put one editorial
comment in the PR.

On Wed, Aug 17, 2016 at 2:22 PM, Jacob Hoffman-Andrews <[email-masked]> wrote:

> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: James Kasten <[email-masked]>
Date: Wed, 17 Aug 2016 13:19:44 -0700

Agreed. The removal greatly simplifies the protocol. As you noted, the
addition of the "application requirements" achieves the same intended
result.