Subject: [Acme] Undoing challenge fulfilling actions

From: Sophie Herold <[email-masked]>
Date: Sun, 7 Jan 2018 18:40:51 +0100

Hi,

I wonder if this paragraph has some special background:

  If the client’s response is invalid for any reason or does not
  provide the server with appropriate information to validate the
  challenge, then the server MUST return an HTTP error. On receiving
  such an error, the client SHOULD undo any actions that have been
  taken to fulfill the challenge, e.g., removing files that have been
  provisioned to a web server.

Is there a reason that undoing challenge fulfilling actions, isn't
mentioned for authorizations becoming final (valid or invalid) at all?
Why is this "rare" case of failing responses the only one covered?

Best,
Sophie

---

From: Jörn Heissler <[email-masked]>
Date: Sun, 7 Jan 2018 19:53:27 +0100

> Why is this "rare" case of failing responses the only one covered?

Hello,

why SHOULD a client undo any actions regardless if an authorization
failed or if the certificate was issued, etc.?
What bad might happen when a file or DNS record is *not* removed?

Maybe this should be rephrased:

    The client MAY undo any actions that have been taken to fulfill a
    challenge, e.g., removing files that have been provisioned to a web
    server, once the authorization is final, i.e. in "valid" or "invalid"
    status.

Related to this: What is the meaning of the "revoked" status of an
authorization?

Cheers,
Jörn

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Mon, 8 Jan 2018 18:01:00 -0800

>> Why is this "rare" case of failing responses the only one covered?

Good question. I'm not aware of any special background here. Certainly
clients should client up after themselves regardless of success or failure.

> Related to this: What is the meaning of the "revoked" status of an
The server may choose to revoke certain authorizations, for instance if
they were validated during a registrar compromise.

---

From: Sophie Herold <[email-masked]>
Date: Tue, 9 Jan 2018 10:27:05 +0100

Hi,

> What bad might happen when a file or DNS record is *not* removed?

I don't have any experiences with DNS servers serving large zone files.
However, if ACME records aren't deleted, they may quickly become the
majority of the records. I imagine, that this could be relevant in the
long run. Assuming that ACME will be used by a considerable proportion
of domains in the future, it might be wise to take measures to curb this
bloat with a SHOULD?

Best,
Sophie

---

From: Jörn Heissler <[email-masked]>
Date: Thu, 11 Jan 2018 20:38:14 +0100

> of domains in the future, it might be wise to take measures to curb this

Hi,
neither do I. My largest zone file was no more than a few Hundred
records. I wouldn't care if my DNS server hosts a total of 3000 or 5000
records. This might add a few Hundred kilobytes of memory usage, so
what.

Large providers with DNS servers for Millions of domains might either
charge their users per record (and earn more money if users keep the
records) or if they manage ACME themselves they could remove the records
when no longer needed.

Whenever I update my zone, the slave servers need to pick up the change.
This adds load too.
Or in the case of e.g. AWS route53, it takes several seconds to do any
change. And for every change a log entry is generated and stored in
CloudTrail.

I'm not familiar with DNSSEC. When you add a new record, I assume
you need to re-sign your zone. Is the same true when you remove a
record?

So there is a chance that removing records will free up a some storage.
But surely there is network + computational overhead at the same time.

We're using rfc2119 terminology here. I don't see enough justification
why records SHOULD be removed. There are good reasons for and reasons
against doing it.
I think that "MAY" fits a lot better here.

Cheers
Jörn