Subject: [Acme] ACME subdomains

From: Felipe Gasper <[email-masked]>
Date: Tue, 4 Aug 2020 19:40:58 -0400

As regards https://tools.ietf.org/html/draft-friel-acme-subdomains-02 ...

Is the idea that the client will, if requesting authz on sub.example.com, *only* be able to do authz against the parent domain (example.com)?

It would seem advantageous—from the client’s perspective, anyway—to allow a workflow where the client can do authz against one or the other. For longer subdomains, e.g., foo.bar.example.com, likewise, ideally the domain itself or either parent domain would work.

Was this considered and deemed infeasible?

Thank you!

-Felipe Gasper

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Tue, 4 Aug 2020 16:52:34 -0700

I haven't followed the "ACME for subdomains" conversation closely, but the
base semantics of ACME are designed such that they can express "all of"
semantics AND "one of" semantics. For a given Order, a client has to fulfil
*all* the Authorizations; for a given Authorization, a client has to
fulfil *one
of* the Challenges.

To take advantage of this, you would need to define a new challenge type
that expresses validating a parent domain. For instance "dns-parent-01." It
would contain the name of the parent domain as a field.

If a server has the policy that validating control of either
foo.bar.example.com or example.com is sufficient to issue for
foo.bar.example.com, it would respond to newOrder requests for
foo.bar.example.com by creating an Order with one Authorization (for
foo.bar.example.com), and that Order would have two Challenges: "dns-01"
and "dns-parent-01" (with a parent domain of "example.com"). The client
could then choose which challenge to attempt.