The IETF approved Automatic Certificate Management Environment (ACME), which will help automate the obtaining of SSL certificates. Let’s explain how it works.
/ Flickr / /
Why the standard is needed
On average, for configuration for a domain, an administrator may spend between one to three hours. If a mistake is made, one has to wait for the application to be rejected before it can be submitted again. This complicates the deployment of large-scale systems.
The domain validation procedure may differ among certification authorities. The lack of standardization often leads to security issues. A well-known , where due to a bug in the system, one CA verified all declared domains. In such situations, SSL certificates can be issued to fraudulent resources.
The IETF-approved ACME protocol (specification ) is intended to automate and standardize the certificate obtaining process. Eliminating the human factor will help to enhance the reliability and security of domain name verification.
The standard is open, and anyone interested can contribute to its development. In the , relevant instructions are published.
How it works
Request exchanges in ACME occur over HTTPS using JSON messages. To work with the protocol, it is necessary to install an ACME client on the target node, which generates a unique key pair upon the first contact with the CA. Subsequently, these keys will be used to sign all messages between the client and the server.
The first message contains the contact information of the domain owner. It is signed with the private key and sent to the server along with the public key. The server verifies the authenticity of the signature and, if everything is in order, begins the SSL certificate issuance procedure.
To obtain a certificate, the client must prove to the server their ownership of the domain. To do this, they perform certain actions available only to the owner. For example, the certification authority may generate a unique token and ask the client to place it on the website. Next, the CA generates an HTTP or DNS request to retrieve the key from this token.
For example, in the case of HTTP, the key from the token must be placed in a file that will be served by the web server. During DNS verification, the certification authority will look for a unique key in the DNS record text document. If everything is in order, the server confirms that the client has passed validation and the CA issues the certificate.
/ Flickr / /
Opinions
According to IETF, ACME will be useful for administrators who need to work with multiple domain names. The standard will help link each of them to the appropriate SSL.
Among the advantages of the standard, experts also note several . They must ensure that SSL certificates are issued only to the actual domain owners. In particular, a set of extensions is used to protect against DNS attacks, , while to protect against DoS, the standard limits the rate of execution of individual requests—for example, HTTP for the method . The developers of ACME adding entropy to DNS requests and performing them from multiple points in the network for increased security.
Similar solutions
Protocols are also used to obtain certificates, and .
The first was developed at Cisco Systems. Its goal was to simplify the procedure for issuing X.509 digital certificates and make it as scalable as possible. Before the advent of SCEP, this process required active participation from sysadmins and was poorly scalable. Today, this protocol is one of the most widely used.
As for EST, it allows PKI clients to obtain certificates over secure channels. It applies TLS for message transmission and SSL issuance, as well as for linking the CSR to the sender. Additionally, EST supports elliptic cryptography methods, providing an extra layer of protection.
According to , solutions like ACME should gain broader adoption. They offer a simplified and secure SSL setup model and speed up the process.
Additional posts from our corporate blog:
Source: habr.com
