Podcast
Root Causes 298: Moving Forward, Together - Promoting Automation


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
April 28, 2023
The Google Chrome root store has communicated its plans for promoting automation. In this episode we explain Chrome's public plans for this initiative, which is anchored around ACME.
Podcast Transcript
Lightly edited for flow and brevity.
The first two paragraphs are really focused on explaining the concept of ACME. ACME, of course, is a very popular API that is used to automate the deployment of certificates. It stands for Automatic Certificate Management Environment, ACME, and Chrome explains what ACME does and also its widespread usage. They cite a couple facts – more than 50% of the certificates issued on the web PKI rely on ACME and about 95% of the certificates issued by the web PKI today are issued by CAs that have some form of ACME implementation in place.
Their point is that ACME really has emerged and is emerging as the standard that we can hope and aspire will be ubiquitous. I think this is part of what they are looking for. That everybody can automate their certificates using every tool on every operating system with every public TLS certificate and that’s the goal they are really going for.
“Unifying the web PKI ecosystem in support of ACME will”
So, there you are. They’re clear. They want to unify the web PKI ecosystem in support of ACME and ACME specifically and by name. Not automation. ACME.
Now they list their six benefits. I think these are worth reading verbatim. “Unifying the web PKI system in support of ACME will:”
1. “Promote ecosystem agility.”
You and I have talked about this in the past: That automation gives you agility and that’s very important as standards change, key files change, cryptographic algorithms change, certificates need to be revoked in mass. All of these things, you need that agility.
2. “Increase resiliency for CA owners and website owners alike.”
3. “Help website owners address scale and complexity challenges related to certificate issuance.“
Any of this sounding familiar, Jay?
4. “Drive innovation through ongoing enhancements and support from an open community.”
In other words, they want ACME to get better.
5. “Ease the transition to quantum-resistant algorithms.”
That’s in there very explicitly and - -
6. “Better position the web PKI ecosystem to manage risk.”
So, those are the six things that Chrome believes, what they view as noble goals that will directly benefit from driving ubiquitous support for ACME throughout the web PKI ecosystem
“In a future policy update, we intend to introduce requirements that all Chrome Root Store applicants must…”
I’m not gonna read this whole thing but basically adhere to a series of ACME quality standards that they are going to demand such as availability and uptime for ACME services, URL disclosures in CCADB and the types of certificate issuance ACME services must support and minimum privileges that must be provided to the Chrome program for evaluation and monitoring of ACME services.
So, first of all, they are gonna have a set of explicit requirements the CA must follow that are gonna be around the quality and availability and scope of ACME services that are provided, and a CA that doesn’t meet those requirements will not be in the root store program. So, how is that for driving ubiquity in the web PKI?
The second thing that they intend to do in a future policy update is that they tend to require that root store participants must support ACME Renewal Information, ARI, which is in a draft RFC right now, which basically means that you will be able to use ACME to renew existing certificates in an automated fashion through ACME. That itself is an important functional improvement over what we have today.

