ACME Integrations
draft-ietf-acme-integrations-00
Network Working Group O. Friel
Internet-Draft R. Barnes
Intended status: Informational Cisco
Expires: July 23, 2020 R. Shekh-Yusef
Avaya
M. Richardson
Sandelman Software Works
January 20, 2020
ACME Integrations
draft-ietf-acme-integrations-00
Abstract
This document outlines multiple advanced use cases and integrations
that ACME facilitates without any modifications or enhancements
required to the base ACME specification. The use cases include ACME
integration with EST, BRSKI and TEAP.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 23, 2020.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
Friel, et al. Expires July 23, 2020 [Page 1]
Internet-Draft ACME-INTEGRATIONS January 2020
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. ACME Integration with EST . . . . . . . . . . . . . . . . . . 3
4. ACME Integration with BRSKI . . . . . . . . . . . . . . . . . 6
5. ACME Integration with BRSKI Default Cloud Registrar . . . . . 8
6. ACME Integration with TEAP . . . . . . . . . . . . . . . . . 10
7. ACME Integration with TEAP-BRSKI . . . . . . . . . . . . . . 14
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
9. Security Considerations . . . . . . . . . . . . . . . . . . . 16
10. Informative References . . . . . . . . . . . . . . . . . . . 16
Appendix A. Comments . . . . . . . . . . . . . . . . . . . . . . 17
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17
1. Introduction
ACME [RFC8555] defines a protocol that a certificate authority (CA)
and an applicant can use to automate the process of domain name
ownership validation and X.509 (PKIX) certificate issuance. The
protocol is rich and flexible and enables multiple use cases that are
not immediately obvious from reading the specification. This
document explicitly outlines multiple advanced ACME use cases
including:
o ACME integration with EST [RFC7030]
o ACME integration with BRSKI
[I-D.ietf-anima-bootstrapping-keyinfra]
o ACME integration with BRSKI Default Cloud Registrar
[I-D.friel-anima-brski-cloud]
o ACME integration with TEAP [RFC7170]
o ACME integration with TEAP-BRSKI [I-D.lear-eap-teap-brski]
The integrations with EST, BRSKI (which is based upon EST), and TEAP
enable automated certificate enrolment for devices.
ACME for subdomains [I-D.friel-acme-subdomains] outlines how ACME can
be used by a client to obtain a certificate for a subdomain
identifier from a certificate authority where the client has
fulfilled a challenge against a parent domain, but does not need to
Friel, et al. Expires July 23, 2020 [Page 2]
Internet-Draft ACME-INTEGRATIONS January 2020
fulfil a challenge against the explicit subdomain. This is a useful
optimisation when ACME is used to issue certificates for large
numbers of devices as it reduces the domain ownership proof traffic
(DNS or HTTP) and ACME traffic overhead, but is not a necessary
Show full document text