Subject: [Acme] Basic ACME question/Open Banking

From: Anders Rundgren <[email-masked]>
Date: Mon, 11 Oct 2021 09:03:09 +0200

Dear ACME experts,

I haven't kept track of ACME so please pardon my somewhat naive question:

In Open Banking, service providers (TPPs) are equipped with TLS client certificates as well as signature certificates.  Currently the certificates (including associated private keys), are distributed by the CA as encrypted files.  This makes updates fairly difficult and not entirely compatible with the highly regulated nature of these providers.

Question: does ACME support this scenario?

thanx,
Anders

---

From: Michael Richardson <[email-masked]>
Date: Mon, 11 Oct 2021 12:41:59 -0400

Anders Rundgren <[email-masked]> wrote:
    > In Open Banking, service providers (TPPs) are equipped with TLS client
    > certificates as well as signature certificates.  Currently the
    > certificates (including associated private keys), are distributed by
    > the CA as encrypted files.  This makes updates fairly difficult and not
    > entirely compatible with the highly regulated nature of these
    > providers.

Who is responsible for renewing the certificates?
Is it the end clients, or the CA?

I don't really see the problem.
I am also not sure, if the certificates and private keys are managed by the
CA, why ACME necessary. It could be used, but it doesn't seem needed.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Anders Rundgren <[email-masked]>
Date: Wed, 13 Oct 2021 14:42:40 +0200

After some research I found https://datatracker.ietf.org/doc/draft-ietf-acme-client/ which almost fills the bill.  What would the preferred procedure be, including challenge?

Attestations like offered by FIDO is not a part of ACME, right?

thanx,
Anders

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 19 Oct 2021 13:00:34 -0400

Hello Anders,

The draft extends ACME to add client challenge methods that might be
helpful. This could be for several use cases including code signing
automation or client certificate management.  Does the draft contain what
you need? The use case from your message is not clear to me.

Thank you,
Kathleen

On Wed, Oct 13, 2021 at 8:42 AM Anders Rundgren <
[email-masked]> wrote:

> After some research I found
> https://datatracker.ietf.org/doc/draft-ietf-acme-client/ which almost
> fills the bill.  What would the preferred procedure be, including challenge?
>
> certificates as well as signature certificates.  Currently the certificates
> (including associated private keys), are distributed by the CA as encrypted
> files.  This makes updates fairly difficult and not entirely compatible
> with the highly regulated nature of these providers.
> >

-- 

Best regards,
Kathleen

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 19 Oct 2021 20:08:00 +0200

On 2021-10-19 19:00, Kathleen Moriarty wrote:
> Hello Anders,
> 
> The draft extends ACME to add client challenge methods that might be helpful. This could be for several use cases including code signing automation or client certificate management.  Does the draft contain what you need? The use case from your message is not clear to me.

Hello Kathleen,
The client is not a person, it is a regulated entity like a payment processor.  These entities need client certificates for calling banks.

Currently CAs distribute encrypted private key + certificate chain for installation in servers.  Both the initial part and possible updates could benefit from a more automated scheme which is why I find your draft interesting.

The scheme could be further strengthened by (in some way...) locking cert requests to the entity's domain as well.
For updates it would be cool if key container attestations also was a part of the plot because requests signed by the original key does not guarantee that the new key is in the same container.  Newer HSMs support attestations.

Does that make sense?

Thanx,
Anders

> 
> Thank you,
> Kathleen
> 
> 
> On Wed, Oct 13, 2021 at 8:42 AM Anders Rundgren <[email-masked] <mailto:[email-masked]>> wrote:
> 
>     After some research I found https://datatracker.ietf.org/doc/draft-ietf-acme-client/ <https://datatracker.ietf.org/doc/draft-ietf-acme-client/> which almost fills the bill.  What would the preferred procedure be, including challenge?
>