Content Delivery Network Interconnection (CDNI) Delegation Using the Automated Certificate Management Environment
Extracted elements (15)
CDNI delegation via ACME avoids sharing private cryptographic key material between upstream and downstream CDNs. The uCDN generates on-demand an X.509 certificate that binds the delegated domain name with a key pair owned by the dCDN, keeping the uCDN in full control and allowing revocation at any time.
The presence or absence of the 'lifetime' property in ACMEDelegationMethod distinguishes STAR from non-STAR delegation. A non-STAR delegation will not have the 'lifetime' property, allowing the dCDN to determine delegation type without an explicit type field.
The delegation object defined in RFC 9115 Section 2.3.1.3 only allows DNS mappings via CNAME RRs. A future document updating RFC 9115 could expand the delegation object to also include SVCB/HTTPS-based mappings (RFC 9460), but this is not currently supported.
For a STAR delegation method, the 'start' and 'end' properties of the time-window object MUST be understood as the start-date and end-date of the certificate validity. For a non-STAR delegation, they MUST be understood as the notBefore and notAfter fields of the certificate.
Implementers MUST adhere to the security considerations defined in Section 7 of RFC 8008 (CDNI Request Routing: Footprint and Capabilities Semantics).
The acme-delegation property URL MUST use the https scheme. It points at an ACME delegation object (either STAR or non-STAR) associated with the dCDN account on the uCDN ACME server.
The 'lifetime' property in ACMEDelegationMethod is mandatory-to-specify only if a STAR delegation method is used. Its absence indicates a non-STAR (long-term certificate) delegation.
The Metadata interface authentication and confidentiality requirements defined in Section 8 of RFC 8006 MUST be followed when using ACMEDelegationMethod metadata.
When TLS is used to achieve security objectives for the CDNI delegation, the general TLS usage guidance in RFC 9325 MUST be followed.
The ACMEDelegationMethod object is a CDNI Metadata interface object that enables delegation of X.509 certificates between a uCDN and dCDN. It contains properties: acme-delegation (URL), time-window (TimeWindow), lifetime (Integer, STAR only), and lifetime-adjust (Integer, optional).
The FCI capability advertisement for ACME delegation uses the CDNI Metadata capability object (capability-type: 'FCI.Metadata') with 'ACMEDelegationMethod' listed in the metadata array, allowing a dCDN to advertise support for the ACME delegation method to a uCDN.
This document registers the payload type 'MI.ACMEDelegationMethod' in the IANA 'CDNI Payload Types' registry, applicable to both the MI (Metadata Interface) and FCI (Footprint and Capabilities Advertisement Interface).
It is critical to protect the dCDN's ACME user account associated with the delegation, as this account authorizes all security-relevant operations between a dCDN and a uCDN over the ACME channel. Compromise of this account undermines the entire delegation scheme.
The acme-delegation resource in the Metadata object is only accessible to the holder of the account key and must be fetched exclusively via POST-as-GET (per Section 2.3.1.2 of RFC 9115). The dCDN's ACME account is relevant to the privacy of the entire scheme.
The ACMEDelegationMethod object is encoded as a JSON generic-metadata object with 'generic-metadata-type' set to 'MI.ACMEDelegationMethod' and 'generic-metadata-value' containing the acme-delegation URL, time-window object, and optional lifetime/lifetime-adjust integers.