Post #3233792
2026-04-27 20:49 UTC
@dalias@hachyderm.io Well as it's currently written, the account needs to be identifiable via a URL, so it forces the ACME server to have its account tied to something in the web server. The API keys for ACME exchanges are URLs, so ACME is already tied to a web server because nobody designs anything outside of the web anymore 😭, but that's one more dependency. Having the equivalent of public keys directly in the DNS, as you suggest, would be conceptually cleaner.
Replies (1)
-
@dalias@hachyderm.io 2026-04-27 20:56
@ska@social.treehouse.systems The ACME protocol runs over HTTP(S). The account identifiers being URIs doesn't mean some state has to exist at that URI; it can be dynamically generated based on the contents of the URI. How the ACME implementation defines and uses its account URIs is entirely implementation-defined.