[cabfpub] Pre-Ballot 169: Revised Validation Requirements

[Ryan Sleevi]

On Tue, May 3, 2016 at 3:02 PM, Richard Barnes <rbarnes at mozilla.com> wrote:

> Hey Ryan,
>
> I'm confused about where you're going here.
>
> It seems like the property that we need to remedy the flaw that Peter
> exposed is that the server's response cannot be generated based on the
> request from the CA.  It seems to me that the right response is just to
> make that requirement explicitly.  As I think JC's text does, though
> perhaps it could be made clearer.
>
> Do you agree with that approach, and we're just arguing about wording?  Or
> do you think the HTTP validation method needs to be even more prescriptive?
>

Well, the wording is to make the HTTP validation method more prescriptive ;)

To be clear: We're discussing wording. Tim proposed some more restrictive
changes, and J.C. raised the concern that ACME relies on the lax language.
The question is fundamentally trying to find out what options we have to
tweak wording or implementation - to try to close the gap so that everyone
is happy.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20160503/b2a44d89/attachment-0003.html>