Hacker News new | past | comments | ask | show | jobs | submit login

Are there any other CAs that support ACME?

Is ACME an Internet standard yet?

Is that turning into monoculture?




Other CAs have made interested noises. Big ones have indicated to m.d.s.policy or CA/B that they are, at least, paying attention to the RFC process and some are participating in standardisation.

ACME is at Working Group Last Call. Which means the IETF Working Group (people who thought this was interesting/ important) thinks it's finished but await feedback from outsiders who might not have realised this was coming or are too busy to look at in-progress designs. It will be published as a Standards Track RFC making it an "Internet Standard" in due course.

A monoculture is at least an improvement over the Wild West we had prior to the Ten Blessed Methods. As recently as last year any CA could decide (on its own recognizance) that any method it chose was adequate to verify Domain Control, under a heading "Any Other Method" in the Baseline Requirements. If your CA was happy with a method so dumb nobody should possibly have used it, we'd have to find out about that, explain why it's dumb, and then you'd get told to stop doing it, often taking several weeks to achieve. A list of just ten explicit methods was written, the Ten Blessed Methods, and now CAs must use one or more of those. ACME implements three today, and is designed to be extensible. Some methods involve things like human lawyers writing physical letters, it is unlikely ACME will embrace that sort of manual process directly, but methods involving email or the WHOIS system could end up in there.


ACME is currently an IETF draft: https://tools.ietf.org/html/draft-ietf-acme-acme-07

As far as I know there's only one serious server-side implementation right now, and that's Let's Encrypt's open-source Boulder project: https://github.com/letsencrypt/boulder




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: