acmebot

acmebot copied to clipboard

HTTP Public Key Pinning is deprecated by browsers, but acmebot don't allow to disable backup_key directory by setting it to null.

As I understand, backup keys need only for HTTP Public Key Pinning, and not used for any other purposes. And now, HTTP Public Key Pinning is deprecated by browsers and this means what backup keys are totally useless. But acmebot don't provide way to disable backup keys generation and storing it on the disk.

Requested feature: please add ability to completely disable backup keys creation by setting in config:

directories:
  backup_key: null

And please consider making backup_key: null default value in future versions of acmebot.

I'm reluctant to remove backup keys entirely.

First, some browsers do still support HPKP, FF behind a flag, which may be used by some in high security environments, as well as some mobile browsers.

Second, they also come into play when using DANE records, which hasn't (yet) caught on for HTTPS, but is used for other protocols.

That said, I'm planning a significant rewrite of acmebot's output processing in the next week or so, adding a generalized templating mechanism. That new system will make it possible to disable backup key files and I'll likely turn them off by default.