The ACME protocol provides the ability to bind an ACME account with a pre-existing account registered with the CA using a secret HMAC key. However, the common way to feed that secret to popular ACME clients is to paste it straight onto the command line, where any user on the same machine can read it. Worse, several major CAs let you reuse the same EAB credential, so a single capture is enough to keep abusing it.

There is a new ACME validation method, dns-persist-01, being standardized at the IETF, and it has even been rolled out to Let’s Encrypt’s staging environment. However, an unresolved security concern is blocking progress on the standard and the roll-out in production for Let’s Encrypt.

dns-persist-01: DNS propagation delays begone!

While ACME has had a DNS-based validation method (dns-01) since the very beginning ¹, it requires real-time updates to DNS for every validation attempt. This creates two issues: