draft-ietf-acme-caa-01.txt   draft-ietf-acme-caa-02.txt 
ACME Working Group H. Landau ACME Working Group H. Landau
Internet-Draft February 04, 2017 Internet-Draft June 30, 2017
Intended status: Standards Track Intended status: Standards Track
Expires: August 8, 2017 Expires: January 1, 2018
CAA Record Extensions for Account URI and ACME Method Binding CAA Record Extensions for Account URI and ACME Method Binding
draft-ietf-acme-caa-01 draft-ietf-acme-caa-02
Abstract Abstract
The CAA DNS record allows a domain to communicate issuance policy to The CAA DNS record allows a domain to communicate issuance policy to
CAs, but only allows a domain to define policy with CA-level CAs, but only allows a domain to define policy with CA-level
granularity. However, the CAA specification also provides facilities granularity. However, the CAA specification also provides facilities
for extension to admit more granular, CA-specific policy. This for extension to admit more granular, CA-specific policy. This
specification defines two such parameters, one allowing specific specification defines two such parameters, one allowing specific
accounts of a CA to be identified by URI and one allowing specific accounts of a CA to be identified by URI and one allowing specific
methods of domain control validation as defined by the ACME protocol methods of domain control validation as defined by the ACME protocol
skipping to change at page 1, line 37 skipping to change at page 1, line 37
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 8, 2017. This Internet-Draft will expire on January 1, 2018.
Copyright Notice Copyright Notice
Copyright (c) 2017 IETF Trust and the persons identified as the Copyright (c) 2017 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 17 skipping to change at page 3, line 17
A CAA parameter "account-uri" is defined for the "issue" and A CAA parameter "account-uri" is defined for the "issue" and
"issuewild" properties defined by [RFC6844]. The value of this "issuewild" properties defined by [RFC6844]. The value of this
parameter, if specified, MUST be a URI [RFC3986] identifying a parameter, if specified, MUST be a URI [RFC3986] identifying a
specific CA account. specific CA account.
"CA account" means an object maintained by a specific CA representing "CA account" means an object maintained by a specific CA representing
a specific entity, or group of related entities, which may request a specific entity, or group of related entities, which may request
the issuance of certificates. the issuance of certificates.
The presence of this parameter constrains the property to which it is The presence of this parameter constrains the property to which it is
attached. A CA MUST only consider a property with an "account-uri" attached. Where a CAA property has an "account-uri" parameter, a CA
parameter to authorize issuance where the URI specified is an URI MUST NOT consider that property to authorize issuance in the context
that the CA recognises as identifying the account making a of a given certificate issuance request unless the CA recognises the
certificate issuance request. URI specified as identifying the account making that request.
If a certificate issuance request is made to a CA such that no If a certificate issuance request is made to a CA such that no
account URI is available, because the request is made in the absence account URI is available, because the request is made in the absence
of any account or the account has no URI assigned to it, a CA MUST of any account or the account has no URI assigned to it, a CA MUST
NOT consider any property having an "account-uri" parameter as NOT consider any property having an "account-uri" parameter as
authorizing issuance. authorizing issuance.
If a CA finds multiple CAA records pertaining to it (i.e., having If a CA finds multiple CAA records pertaining to it (i.e., having
property "issue" or "issuewild" as applicable and a domain that the property "issue" or "issuewild" as applicable and a domain that the
CA recognises as its own) with different "account-uri" parameters, CA recognises as its own) with different "account-uri" parameters,
skipping to change at page 8, line 19 skipping to change at page 8, line 19
None. As per the CAA specification, the parameter namespace for the None. As per the CAA specification, the parameter namespace for the
CAA "issue" and "issuewild" properties has CA-defined semantics. CAA "issue" and "issuewild" properties has CA-defined semantics.
This document merely specifies a RECOMMENDED semantic for parameters This document merely specifies a RECOMMENDED semantic for parameters
of the names "account-uri" and "acme-methods". of the names "account-uri" and "acme-methods".
7. Normative References 7. Normative References
[I-D.ietf-acme-acme] [I-D.ietf-acme-acme]
Barnes, R., Hoffman-Andrews, J., and J. Kasten, "Automatic Barnes, R., Hoffman-Andrews, J., and J. Kasten, "Automatic
Certificate Management Environment (ACME)", draft-ietf- Certificate Management Environment (ACME)", draft-ietf-
acme-acme-05 (work in progress), February 2017. acme-acme-07 (work in progress), June 2017.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/ Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
RFC2119, March 1997, RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>. <http://www.rfc-editor.org/info/rfc2119>.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66, RFC Resource Identifier (URI): Generic Syntax", STD 66, RFC
3986, DOI 10.17487/RFC3986, January 2005, 3986, DOI 10.17487/RFC3986, January 2005,
<http://www.rfc-editor.org/info/rfc3986>. <http://www.rfc-editor.org/info/rfc3986>.
 End of changes. 6 change blocks. 
9 lines changed or deleted 9 lines changed or added

This html diff was produced by rfcdiff 1.45. The latest version is available from http://tools.ietf.org/tools/rfcdiff/