On Wed, Mar 14, 2018 at 17:57:43 +0000, Hugo Landau wrote: > > Rationale is that the client shouldn't blindly trust that the chain > > received by the acme server is valid. > See my other reply. But to respond to this specifically, can you explain > what threat model is mitigated > by distrusting the chain served by the ACME server?
It's certainly far-fetched: Assume you've currently got a valid certificate installed. It will expire in 3 Weeks, so you're going to renew it. The CDN in front of the ACME server, or your enterprise MitM appliance, could send you a broken certificate. If you blindly install it, your website will be down immediately. If you verify the cert+chain and thus notice the problem, you've got three Weeks to address the problem. So it mitigates a possible DoS by a malicious party or simply some malfunction somewhere.
signature.asc
Description: PGP signature
_______________________________________________ Acme mailing list [email protected] https://www.ietf.org/mailman/listinfo/acme
