Subject: [Acme] Remove the hyphen from the acceptable character set for _acme-challenge TXT records.

From: Mark Tomlin <[email-masked]>
Date: Wed, 25 Nov 2020 16:19:36 -0500

Hello everyone,
    I have a bit of a feature request for you all. It's actually to remove
the hyphen from the TXT records to make it easier to copy and paste into a
DNS server record. Here's my scenario. I ran the following command on my
server (Ubuntu 20.04) that as you can see has cerbot on it and a large
number of domains to cover.

certbot certonly --manual --preferred-challenges=dns --email [email-masked]
--server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d
mimocad.io -d *.mimocad.io -d stonybrookems.io -d *.stonybrookems.io -d
stonybrookems.com -d *.stonybrookems.com -d stonybrookems.net -d *.
stonybrookems.net -d stonybrookems.org -d *.stonybrookems.org -d wlvac.com
-d *.wlvac.com -d wlvac.net -d *.wlvac.net -d wlvac.org -d *.wlvac.org -d
wlvacems.com -d *.wlvacems.com -d wlvacems.net -d *.wlvacems.net -d
wlvacems.org -d *.wlvacems.org -d mimosdr.com -d *.mimosdr.com -d
mimosdr.net -d *.mimosdr.net -d mimosdr.org -d *.mimosdr.org

While running that command I would get an output like the following...

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- -
Please deploy a DNS TXT record under the name
_acme-challenge.mimocad.io with the following value:

6-K6v7VjtVpGhJk4d6Zx8qxsg6JFUZbGnnr-bDpKpSc

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- -
Press Enter to Continue

Normal and expected behavior, yes. My issue is with the hyphen character.
>From my client machine macOS 11.0.1 when I'm copying DNS records with a
double click of the string it stops at spaces appropriately but it stops at
hyphens also. In essence, the expected operation of capturing the whole
string inside of the select via double click does not work. This behavior
is certainly produced in my environment and I would think in others as
well. Try it yourself and see what happens! My request is that we simply
discourage or disallow the use of the hyphen in the _acme-challenge TXT
records as it offers poor usability for the accurate copy of these long
complex strings from the console output into the DNS server.

Thank you for your time,
Respectfully.

--
Mark Tomlin, CEO.
MimoCAD Inc.

---

From: Matt Holt <[email-masked]>
Date: Wed, 25 Nov 2020 14:29:24 -0700

I believe this kind of request should go to the app within which the copying is done, not the ACME spec. Ultimately, the vision of ACME is to automate certificate management and to do away with any need for manual copy and paste, so in my opinion changing the spec to bend to a manual workflow seems counter-productive.Matt ---- On Wed, 25 Nov 2020 14:19:36 -0700  [email-masked]  wrote ----Hello everyone,    I have a bit of a feature request for you all. It's actually to remove the hyphen from the TXT records to make it easier to copy and paste into a DNS server record. Here's my scenario. I ran the following command on my server (Ubuntu 20.04) that as you can see has cerbot on it and a large number of domains to cover.certbot certonly --manual --preferred-challenges=dns --email [email-masked] --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d mimocad.io -d *.mimocad.io -d stonybrookems.io -d *.stonybrookems.io -d stonybrookems.com -d *.stonybrookems.com -d stonybrookems.net -d *.stonybrookems.net -d stonybrookems.org -d *.stonybrookems.org -d wlvac.com -d *.wlvac.com -d wlvac.net -d *.wlvac.net -d wlvac.org -d *.wlvac.org -d wlvacems.com -d *.wlvacems.com -d wlvacems.net -d *.wlvacems.net -d wlvacems.org -d *.wlvacems.org -d mimosdr.com -d *.mimosdr.com -d mimosdr.net -d *.mimosdr.net -d mimosdr.org -d *.mimosdr.orgWhile running that command I would get an output like the following...- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Please deploy a DNS TXT record under the name_acme-challenge.mimocad.io with the following value:6-K6v7VjtVpGhJk4d6Zx8qxsg6JFUZbGnnr-bDpKpScBefore continuing, verify the record is deployed.- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Press Enter to ContinueNormal and expected behavior, yes. My issue is with the hyphen character. From my client machine macOS 11.0.1 when I'm copying DNS records with a double click of the string it stops at spaces appropriately but it stops at hyphens also. In essence, the expected operation of capturing the whole string inside of the select via double click does not work. This behavior is certainly produced in my environment and I would think in others as well. Try it yourself and see what happens! My request is that we simply discourage or disallow the use of the hyphen in the _acme-challenge TXT records as it offers poor usability for the accurate copy of these long complex strings from the console output into the DNS server.Thank you for your time,Respectfully.--Mark Tomlin, CEO.MimoCAD Inc.
_______________________________________________
Acme mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/acme

---

From: Michael Richardson <[email-masked]>
Date: Wed, 25 Nov 2020 17:37:06 -0500

> number of domains to cover.

It is annoying, and I've run into the same problem as well.
The challenge is a base64url encoded (RFC4648) nonce.  It is preferred by web
programmers because it does not use + or /, which are special in URLs.
The base64 alphabet doesn't use -, but does use + and /, but which would
copy and paste better.

The format and contents of the nonce are not mandated by RFC8555, so
LetsEncrypt change this in many different ways.
It would be a unilateral decision on the ACME server only.

I actually think that BASE32 encoding would probably better: you could
probably write a pull-request to the letencrypt code base to do this.
I don't know how they would feel about this, but it would be worth learning.

    > 6-K6v7VjtVpGhJk4d6Zx8qxsg6JFUZbGnnr-bDpKpSc

What annoyed me here when renewing a system with 10 different aliases is that
I don't know when I've gotten to the last one.  I should be shown all
10 at the same time, so that I can put them all in place, and then reload the
zone.  Instead, I count (badly), reload the zone too late or too soon...
Even better if they add the entire DNS presentation lines so that
I could copy&paste the entire set.
But, again, this is a client code issue, and not a protocol issue.

I have since bit the bullet and gotten nsupdate to do the right thing,
and it now autorenews on it's own, as Ghod intended.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: "Manger, James" <[email-masked]>
Date: Wed, 25 Nov 2020 22:54:45 +0000

An Acme CA may choose the dns-01 challenge token, but what goes in the DNS TXT record is base64url(SHA-256(f(token and account key))).
So to avoid hyphens in that result the CA would need to: pick a random token; do the hash & base64url calculations; then repeat with a new random token if any hyphens are present. It will only take 2 tries on average ; - )

--
James Manger

-----Original Message-----
From: Acme <[email-masked]> On Behalf Of Michael Richardson
Sent: Thursday, 26 November 2020 9:37 AM
To: Mark Tomlin <[email-masked]>; [email-masked]
Subject: Re: [Acme] Remove the hyphen from the acceptable character set for _acme-challenge TXT records.

[External Email] This email was sent from outside the organisation – be cautious, particularly with links and attachments.

It is annoying, and I've run into the same problem as well.
The challenge is a base64url encoded (RFC4648) nonce.  It is preferred by web programmers because it does not use + or /, which are special in URLs.
The base64 alphabet doesn't use -, but does use + and /, but which would copy and paste better.

The format and contents of the nonce are not mandated by RFC8555, so LetsEncrypt change this in many different ways.
It would be a unilateral decision on the ACME server only.

I actually think that BASE32 encoding would probably better: you could probably write a pull-request to the letencrypt code base to do this.
I don't know how they would feel about this, but it would be worth learning.

    > 6-K6v7VjtVpGhJk4d6Zx8qxsg6JFUZbGnnr-bDpKpSc

What annoyed me here when renewing a system with 10 different aliases is that I don't know when I've gotten to the last one.  I should be shown all
10 at the same time, so that I can put them all in place, and then reload the zone.  Instead, I count (badly), reload the zone too late or too soon...
Even better if they add the entire DNS presentation lines so that I could copy&paste the entire set.
But, again, this is a client code issue, and not a protocol issue.

I have since bit the bullet and gotten nsupdate to do the right thing, and it now autorenews on it's own, as Ghod intended.

---

From: Michael Richardson <[email-masked]>
Date: Wed, 25 Nov 2020 20:34:31 -0500

Manger, James <[email-masked]> wrote:
    > An Acme CA may choose the dns-01 challenge token, but what goes in the
    > DNS TXT record is base64url(SHA-256(f(token and account key))).

I don't see this anywhere in RFC8555.
I see section 8.1, which deals with a keyAuthorization.

section 8.4 says that the token must have 128-bits of entropy,
and that it should restrict itself to the base64url alphabet.

Beyond that, I don't see any formula like above: an ACME server could, as you
say below, notice when needed "-" in the result and try again.
I think we are agreeing, but you are just telling me what current code does?

    > So to avoid hyphens in that result the CA would need to: pick a random
    > token; do the hash & base64url calculations; then repeat with a new
    > random token if any hyphens are present. It will only take 2 tries on
    > average ; - )