ACME authentication?

[reesericci]

It seems that when I enable the acme provisioner that any website that makes a valid acme request to my CA will get a certificate. Any way to add some kind of authentication or a manual queue to get certs signed?

[maraino]

No right now @dopey, is that right? But it's something that will be available soon.

[maraino]

But right now it's possible to create an intermediate with some name constraints that will make the leaf certificate untrusted. But they can still sign certificates.

[maraino]

A template for an intermediate with name constraints looks like:

{
    "subject": {{ toJson .Subject }},
    "keyUsage": ["certSign", "crlSign"],
    "basicConstraints": {
        "isCA": true,
        "maxPathLen": 0
    },
    "nameConstraints": {
        "critical": true,
        "permittedDNSDomains": "jane.doe.com",
        "excludedDNSDomains": "john.doe.com",
        "permittedIPRanges": "127.0.0.1/32",
        "excludedIPRanges": "0.0.0.0/0",
        "permittedEmailAddresses": "[email protected]",
        "excludedEmailAddresses": "[email protected]",
        "permittedURIDomains": "https://jane.doe.com",
        "excludedURIDomains": "https://john.doe.com"
    }
}

[maraino]

There's also some checks that you can do on certificate templates, like looping through the DNS names and making sure they match a specific pattern.

[reesericci]

ok will try

[dopey]

@maraino that's accurate. As mariano said, we'll be releasing some features soon to "firewall" the API, but until then it acts as a normal ACME server would. Meaning that anything addressable can request and receive a certificate.

[dopey]

@maraino You can already run step-ca as an ACME RA on a private network that makes signing requests out to a public step-ca instance (using JWK, x5c, etc), right? If you want protection around your ACME server.

[reesericci]

what is an RA?

[dopey]

An RA is our shorthand for Registration Authority. A registration authority authenticates and "registers" the initial request, but then sends the signing action to a different certificate authority. For example, suppose you were using GCP CAS (their certificate authority service). CAS does not support ACME. But step-ca does. So you could run step-ca in Registration Authority mode where step-ca will do the ACME flow but then reach out to CAS for the actual signing certificate signing. This means that you could run an instance of step-ca from within your private network and then delegate the signing part to an external authority.

[dopey]

I'm not sure it would actually help in your use case though. If you could run step-ca internally and have it resolve your ACME requests you'd probably already be doing that (instead of running it exposed to the internet).

[reesericci]

thats not a terrible idea