[Acme] Turning off old/insecure challenge types

Josh Aas <josh@letsencrypt.org> Sat, 14 November 2015 19:33 UTC

MIME-Version: 1.0
Date: Sat, 14 Nov 2015 13:33:40 -0600
Message-ID: <CAJH38kEg9Hrd3nnZ-pcn+kwDTUS8c+CXUeYJaOkXfALkLQVmcg@mail.gmail.com>
From: Josh Aas <josh@letsencrypt.org>
To: acme@ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/acme/SeV8tlnDggwcFZAO_3j22EjjC4A>
Subject: [Acme] Turning off old/insecure challenge types
Precedence: list

Let's Encrypt will no longer be offering the "simpleHttp" and "dvsni"
challenges as of Thursday, November 18.  If your client depends on
these challenges, you will need to update to the "http-01" or
"tls-sni-01" challenges by that date, or your client will no longer
work.  The current version of the official Let's Encrypt client
supports the new challenges.

This change is required because these older challenges have a
signature reuse vulnerability, reported on the IETF ACME list by
Andrew Ayer several weeks ago.

Also, please note: The "tls-sni-01" challenge currently offered by
Let's Encrypt is currently not compatible with the "tls-sni-01"
challenge defined in draft-ietf-acme-acme-01.  It lacks the "n"
parameter.  This is a known issue, and will be resolved once the IETF
ACME working group decides whether to keep the "n" parameter.

-- 
Josh Aas
Executive Director
Internet Security Research Group

[Acme] Turning off old/insecure challenge types Josh Aas