Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change how the validation label is constructed #25

Merged
merged 5 commits into from
Feb 10, 2024
Merged

Change how the validation label is constructed #25

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
23cf066
Change how the validation label is constructed
aaomidi Sep 1, 2023
ca38d9d
Stray underline
aaomidi Sep 1, 2023
ca6ef16
prefixing -> prepending
aaomidi Sep 1, 2023
17dfe71
Review changes
aaomidi Sep 7, 2023
19e266f
Merge branch 'main' into dnsops
aaomidi Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 2 additions & 14 deletions draft-ietf-acme-dns-account-01.mkd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ A client can fulfill this challenge by performing the following steps:
- Compute the SHA-256 digest {{FIPS180-4}} of the key authorization
- Construct the validation domain name by prepending the following label to the domain name being validated:

"_acme-challenge_" || base32(SHA-256(Account Resource URL)[0:9])
"_" || base32(SHA-256(Account Resource URL)[0:9]) || "_acme-challenge"

- SHA-256 is the SHA hashing operation defined in {{!RFC6234}}
- `[0:9]` is the operation that selects the first ten bytes (bytes 0 through 9 inclusive) from the previous SHA256 operation
Expand All @@ -135,7 +135,7 @@ A client can fulfill this challenge by performing the following steps:
For example, if the domain name being validated is "www.example.org", and the account URL of "https://example.com/acme/acct/ExampleAccount" then the client would provision the following DNS record:

~~~
_acme-challenge_ujmmovf2vn55tgye.www.example.org 300 IN TXT "LoqXcYV8...jxAjEuX0.9jg46WB3...fm21mqTI"
_ujmmovf2vn55tgye._acme-challenge.www.example.org 300 IN TXT "LoqXcYV8...jxAjEuX0.9jg46WB3...fm21mqTI"
~~~

(In the above, "..." indicates that the token and the JWK thumbprint in the key authorization have been truncated to fit on the page.)
Expand Down Expand Up @@ -194,18 +194,6 @@ The first 10 bytes were picked as a tradeoff: the value needs to be short enough

# IANA Considerations

## DNS Parameters

The Underscored and Globally Scoped DNS Node Names is to be updated to include the following entry:

~~~
RR Type: TXT
_NODE NAME: _acme-challenge_*
Reference: This document
~~~

Where `_acme-challenge_*` denotes all node names beginning with the string `_acme-challenge_`. It does NOT refer to a DNS wildcard specification.

## ACME Validation Method

The "ACME Validation Methods" registry is to be updated to include the following entry:
Expand Down