Session Date/Time: 22 Jul 2025 09:30

acme

Summary

The ACME working group meeting covered document status updates, presentations on several draft proposals, and discussions regarding their direction and potential adoption. Key topics included client authentication challenges, auto-discovery of ACME servers, public key challenges, ACME RATS integration, JWT claim constraints in STIR certificates, ACME profiles and persistent DNS validation.

Key Discussion Points

Document Status:
- Two new RFCs published: RFC 9773 (ARI) and RFC 9799 (Onion).
- Several drafts are in the RFC editor's queue or undergoing revisions.
Client Authentication Challenge Types:
- Discussion on the usefulness and implementation status of the client challenge type draft.
- Concerns were raised about the scope and potential overlap with other drafts, particularly concerning WebAuthn.
- Debate on whether this represents a fundamental change to ACME.
Auto-Discovery of ACME Servers:
- Discussion on the need for auto-discovery mechanisms for different identifier types, including those beyond DNS names.
- The draft is looking for a new lead author who can champion adoption, especially someone from a major vendor.
Public Key Challenges:
- The presenter clarified that the use case in this scenario is for enterprise or campus contexts.
- Concerns were raised about the practical necessity and security model of the proposed solution.
ACME RATS Integration:
- Discussion about combining the RATS process with the ACME process to improve device security.
- Debate on where the attestation information should be placed within the Acme protocol flow (challenge vs. order payload).
Extension of Public Key Challenges for JWT claim constraints:
- A question was raised about handling multiple challenges with different authorities.
Persistent DNS Validation in ACME:
- Discussion on implementing static TXT records for DNS validation.
- Emphasis on aligning with the CA/Browser Forum's efforts on this front.

Decisions and Action Items

Client Authentication Challenge Types: Kathleen will address the feedback and decide whether a new draft should be uploaded. Chairs to start a mailing list thread on this.
Auto-Discovery of ACME Servers: Mike is looking for someone from a CA or CSP to take lead of this draft.
ACME RATS Integration: Discuss placing attestation result into the order payload in the main list.

Next Steps

Continue discussion of open issues on the mailing list.
Coordinate efforts on similar drafts (e.g., client authentication challenges, persistent DNS validation) to avoid duplication and ensure alignment.
Continue the Akimirat design team meeting to discuss design and potentially call for adoption in Montreal.