letsencrypt / boulder

An ACME-based certificate authority, written in Go.
Mozilla Public License 2.0
5.16k stars 605 forks source link

WFE: Normalize names at the WFE #7555

Closed beautifulentropy closed 3 months ago

beautifulentropy commented 3 months ago

Modify the contract between WFE.NewOrder and RA.NewOrder to expect normalized names from the WFE. This adjustment is a part of a two-phase update, where RA will eventually stop normalizing names, avoiding redundancy.

Phase 1:

Phase 2:

aarongable commented 3 months ago

(This came out of a comment on https://github.com/letsencrypt/boulder/pull/7554)

I'm not actually arguing in favor of this, I just said I thought we should think about it :)

It's not clear to me that it's a good idea to change the contract between the WFE and the RA -- the RA is where we have the vast majority of our safety logic, and that's a good norm to preserve. Also, there's basically zero cost to calling UniqueLowerNames twice, just in case.

My comment was more about: