I-D Action: draft-geng-acme-sm2dualcert-extension-00.txt

Internet-Draft draft-geng-acme-sm2dualcert-extension-00.txt is now available.

   Title:   ACME Extension for SM2 Dual-Certificate System
   Authors: Feng Geng
            Panyu Wu
            Guilin Wang
            Xin Chen
   Name:    draft-geng-acme-sm2dualcert-extension-00.txt
   Pages:   51
   Dates:   2026-07-20

Abstract:

   This document describes the extension of the ACME protocol [RFC8555]
   to support automated issuance of SM2 dual certificates (signature
   certificates and encryption certificates) in the Chinese National
   Cryptography certificate system.  This document does not represent
   IETF consensus; the technical solution is applicable only to PKI
   environments based on an SM2 dual-certificate system.

   Under the framework of the ACME protocol [RFC8555], this document
   proposes using two separate Orders to request the two certificates.
   For the signature certificate, the existing ACME workflow is reused,
   optionally using the standard CSR approach or the pk-01 challenge
   [I-D.geng-acme-public-key].  For the encryption certificate, this
   document defines a new challenge type, auth-01, specifically for
   *identity authorization* scenarios: the client proves possession of
   the *signature private key* to authorize the Key Management Center
   (KMC) to generate an encryption key pair and issue the encryption
   certificate on behalf of the entity.  This challenge type
   intrinsically binds the issuance of the encryption certificate to the
   signature key, requiring no additional binding identifiers.

   All extensions are compatible with the existing ACME resource model.
   No new Order types are introduced.  This document only adds optional
   fields in the client's newOrder request (authKey, includeEnvelope)
   and an additional field in the server's response (envelope), without
   changing the core semantics or state machine of Order.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-geng-acme-sm2dualcert-extension/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-geng-acme-sm2dualcert-extension-00.html

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]