File: rfc9115.html

package info (click to toggle)
doc-rfc 20230121-1
links: PTS, VCS
area: non-free
in suites: bookworm, forky, sid, trixie
size: 1,609,944 kB
file content (4993 lines) | stat: -rw-r--r-- 328,153 bytes
<!DOCTYPE html>
<html lang="en" class="RFC">
<head>
<meta charset="utf-8">
<meta content="Common,Latin" name="scripts">
<meta content="initial-scale=1.0" name="viewport">
<title>RFC 9115: An Automatic Certificate Management Environment (ACME) Profile for Generating Delegated Certificates</title>
<meta content="Yaron Sheffer" name="author">
<meta content="Diego López" name="author">
<meta content="Antonio Agustín Pastor Perales" name="author">
<meta content="Thomas Fossati" name="author">
<meta content="
       This document defines a profile of the Automatic Certificate Management Environment
(ACME) protocol by which the holder of an identifier (e.g., a domain name) can
allow a third party to obtain an X.509 certificate such that the certificate
subject is the delegated identifier while the certified public key corresponds
to a private key controlled by the third party.
A primary use case is that of a Content Delivery Network (CDN), the third party,
terminating TLS sessions on behalf of a content provider (the holder of a domain
name).  The presented mechanism allows the holder of the identifier to retain
control over the delegation and revoke it at any time.  Importantly, this
mechanism does not require any modification to the deployed TLS
clients and servers. 
    " name="description">
<meta content="xml2rfc 3.9.1" name="generator">
<meta content="Content Delivery Network" name="keyword">
<meta content="CDN" name="keyword">
<meta content="9115" name="rfc.number">
<!-- Generator version information:
  xml2rfc 3.9.1
    Python 3.6.10
    appdirs 1.4.4
    ConfigArgParse 1.2.3
    google-i18n-address 2.3.5
    html5lib 1.0.1
    intervaltree 3.0.2
    Jinja2 2.11.2
    kitchen 1.2.6
    lxml 4.4.2
    pycairo 1.19.0
    pycountry 19.8.18
    pyflakes 2.1.1
    PyYAML 5.3.1
    requests 2.22.0
    setuptools 40.6.2
    six 1.14.0
    WeasyPrint 51
-->
<link href="rfc9115.xml" rel="alternate" type="application/rfc+xml">
<link href="#copyright" rel="license">
<style type="text/css">/*

  NOTE: Changes at the bottom of this file overrides some earlier settings.

  Once the style has stabilized and has been adopted as an official RFC style,
  this can be consolidated so that style settings occur only in one place, but
  for now the contents of this file consists first of the initial CSS work as
  provided to the RFC Formatter (xml2rfc) work, followed by itemized and
  commented changes found necssary during the development of the v3
  formatters.

*/

/* fonts */
@import url('https://fonts.googleapis.com/css?family=Noto+Sans'); /* Sans-serif */
@import url('https://fonts.googleapis.com/css?family=Noto+Serif'); /* Serif (print) */
@import url('https://fonts.googleapis.com/css?family=Roboto+Mono'); /* Monospace */

@viewport {
  zoom: 1.0;
  width: extend-to-zoom;
}
@-ms-viewport {
  width: extend-to-zoom;
  zoom: 1.0;
}
/* general and mobile first */
html {
}
body {
  max-width: 90%;
  margin: 1.5em auto;
  color: #222;
  background-color: #fff;
  font-size: 14px;
  font-family: 'Noto Sans', Arial, Helvetica, sans-serif;
  line-height: 1.6;
  scroll-behavior: smooth;
}
.ears {
  display: none;
}

/* headings */
#title, h1, h2, h3, h4, h5, h6 {
  margin: 1em 0 0.5em;
  font-weight: bold;
  line-height: 1.3;
}
#title {
  clear: both;
  border-bottom: 1px solid #ddd;
  margin: 0 0 0.5em 0;
  padding: 1em 0 0.5em;
}
.author {
  padding-bottom: 4px;
}
h1 {
  font-size: 26px;
  margin: 1em 0;
}
h2 {
  font-size: 22px;
  margin-top: -20px;  /* provide offset for in-page anchors */
  padding-top: 33px;
}
h3 {
  font-size: 18px;
  margin-top: -36px;  /* provide offset for in-page anchors */
  padding-top: 42px;
}
h4 {
  font-size: 16px;
  margin-top: -36px;  /* provide offset for in-page anchors */
  padding-top: 42px;
}
h5, h6 {
  font-size: 14px;
}
#n-copyright-notice {
  border-bottom: 1px solid #ddd;
  padding-bottom: 1em;
  margin-bottom: 1em;
}
/* general structure */
p {
  padding: 0;
  margin: 0 0 1em 0;
  text-align: left;
}
div, span {
  position: relative;
}
div {
  margin: 0;
}
.alignRight.art-text {
  background-color: #f9f9f9;
  border: 1px solid #eee;
  border-radius: 3px;
  padding: 1em 1em 0;
  margin-bottom: 1.5em;
}
.alignRight.art-text pre {
  padding: 0;
}
.alignRight {
  margin: 1em 0;
}
.alignRight > *:first-child {
  border: none;
  margin: 0;
  float: right;
  clear: both;
}
.alignRight > *:nth-child(2) {
  clear: both;
  display: block;
  border: none;
}
svg {
  display: block;
}
.alignCenter.art-text {
  background-color: #f9f9f9;
  border: 1px solid #eee;
  border-radius: 3px;
  padding: 1em 1em 0;
  margin-bottom: 1.5em;
}
.alignCenter.art-text pre {
  padding: 0;
}
.alignCenter {
  margin: 1em 0;
}
.alignCenter > *:first-child {
  border: none;
  /* this isn't optimal, but it's an existence proof.  PrinceXML doesn't
     support flexbox yet.
  */
  display: table;
  margin: 0 auto;
}

/* lists */
ol, ul {
  padding: 0;
  margin: 0 0 1em 2em;
}
ol ol, ul ul, ol ul, ul ol {
  margin-left: 1em;
}
li {
  margin: 0 0 0.25em 0;
}
.ulCompact li {
  margin: 0;
}
ul.empty, .ulEmpty {
  list-style-type: none;
}
ul.empty li, .ulEmpty li {
  margin-top: 0.5em;
}
ul.ulBare, li.ulBare {
  margin-left: 0em !important;
}
ul.compact, .ulCompact,
ol.compact, .olCompact {
  line-height: 100%;
  margin: 0 0 0 2em;
}

/* definition lists */
dl {
}
dl > dt {
  float: left;
  margin-right: 1em;
}
/* 
dl.nohang > dt {
  float: none;
}
*/
dl > dd {
  margin-bottom: .8em;
  min-height: 1.3em;
}
dl.compact > dd, .dlCompact > dd {
  margin-bottom: 0em;
}
dl > dd > dl {
  margin-top: 0.5em;
  margin-bottom: 0em;
}

/* links */
a {
  text-decoration: none;
}
a[href] {
  color: #22e; /* Arlen: WCAG 2019 */
}
a[href]:hover {
  background-color: #f2f2f2;
}
figcaption a[href],
a[href].selfRef {
  color: #222;
}
/* XXX probably not this:
a.selfRef:hover {
  background-color: transparent;
  cursor: default;
} */

/* Figures */
tt, code, pre, code {
  background-color: #f9f9f9;
  font-family: 'Roboto Mono', monospace;
}
pre {
  border: 1px solid #eee;
  margin: 0;
  padding: 1em;
}
img {
  max-width: 100%;
}
figure {
  margin: 0;
}
figure blockquote {
  margin: 0.8em 0.4em 0.4em;
}
figcaption {
  font-style: italic;
  margin: 0 0 1em 0;
}
@media screen {
  pre {
    overflow-x: auto;
    max-width: 100%;
    max-width: calc(100% - 22px);
  }
}

/* aside, blockquote */
aside, blockquote {
  margin-left: 0;
  padding: 1.2em 2em;
}
blockquote {
  background-color: #f9f9f9;
  color: #111; /* Arlen: WCAG 2019 */
  border: 1px solid #ddd;
  border-radius: 3px;
  margin: 1em 0;
}
cite {
  display: block;
  text-align: right;
  font-style: italic;
}

/* tables */
table {
  width: 100%;
  margin: 0 0 1em;
  border-collapse: collapse;
  border: 1px solid #eee;
}
th, td {
  text-align: left;
  vertical-align: top;
  padding: 0.5em 0.75em;
}
th {
  text-align: left;
  background-color: #e9e9e9;
}
tr:nth-child(2n+1) > td {
  background-color: #f5f5f5;
}
table caption {
  font-style: italic;
  margin: 0;
  padding: 0;
  text-align: left;
}
table p {
  /* XXX to avoid bottom margin on table row signifiers. If paragraphs should
     be allowed within tables more generally, it would be far better to select on a class. */
  margin: 0;
}

/* pilcrow */
a.pilcrow {
  color: #666; /* Arlen: AHDJ 2019 */
  text-decoration: none;
  visibility: hidden;
  user-select: none;
  -ms-user-select: none;
  -o-user-select:none;
  -moz-user-select: none;
  -khtml-user-select: none;
  -webkit-user-select: none;
  -webkit-touch-callout: none;
}
@media screen {
  aside:hover > a.pilcrow,
  p:hover > a.pilcrow,
  blockquote:hover > a.pilcrow,
  div:hover > a.pilcrow,
  li:hover > a.pilcrow,
  pre:hover > a.pilcrow {
    visibility: visible;
  }
  a.pilcrow:hover {
    background-color: transparent;
  }
}

/* misc */
hr {
  border: 0;
  border-top: 1px solid #eee;
}
.bcp14 {
  font-variant: small-caps;
}

.role {
  font-variant: all-small-caps;
}

/* info block */
#identifiers {
  margin: 0;
  font-size: 0.9em;
}
#identifiers dt {
  width: 3em;
  clear: left;
}
#identifiers dd {
  float: left;
  margin-bottom: 0;
}
#identifiers .authors .author {
  display: inline-block;
  margin-right: 1.5em;
}
#identifiers .authors .org {
  font-style: italic;
}

/* The prepared/rendered info at the very bottom of the page */
.docInfo {
  color: #666; /* Arlen: WCAG 2019 */
  font-size: 0.9em;
  font-style: italic;
  margin-top: 2em;
}
.docInfo .prepared {
  float: left;
}
.docInfo .prepared {
  float: right;
}

/* table of contents */
#toc  {
  padding: 0.75em 0 2em 0;
  margin-bottom: 1em;
}
nav.toc ul {
  margin: 0 0.5em 0 0;
  padding: 0;
  list-style: none;
}
nav.toc li {
  line-height: 1.3em;
  margin: 0.75em 0;
  padding-left: 1.2em;
  text-indent: -1.2em;
}
/* references */
.references dt {
  text-align: right;
  font-weight: bold;
  min-width: 7em;
}
.references dd {
  margin-left: 8em;
  overflow: auto;
}

.refInstance {
  margin-bottom: 1.25em;
}

.references .ascii {
  margin-bottom: 0.25em;
}

/* index */
.index ul {
  margin: 0 0 0 1em;
  padding: 0;
  list-style: none;
}
.index ul ul {
  margin: 0;
}
.index li {
  margin: 0;
  text-indent: -2em;
  padding-left: 2em;
  padding-bottom: 5px;
}
.indexIndex {
  margin: 0.5em 0 1em;
}
.index a {
  font-weight: 700;
}
/* make the index two-column on all but the smallest screens */
@media (min-width: 600px) {
  .index ul {
    -moz-column-count: 2;
    -moz-column-gap: 20px;
  }
  .index ul ul {
    -moz-column-count: 1;
    -moz-column-gap: 0;
  }
}

/* authors */
address.vcard {
  font-style: normal;
  margin: 1em 0;
}

address.vcard .nameRole {
  font-weight: 700;
  margin-left: 0;
}
address.vcard .label {
  font-family: "Noto Sans",Arial,Helvetica,sans-serif;
  margin: 0.5em 0;
}
address.vcard .type {
  display: none;
}
.alternative-contact {
  margin: 1.5em 0 1em;
}
hr.addr {
  border-top: 1px dashed;
  margin: 0;
  color: #ddd;
  max-width: calc(100% - 16px);
}

/* temporary notes */
.rfcEditorRemove::before {
  position: absolute;
  top: 0.2em;
  right: 0.2em;
  padding: 0.2em;
  content: "The RFC Editor will remove this note";
  color: #9e2a00; /* Arlen: WCAG 2019 */
  background-color: #ffd; /* Arlen: WCAG 2019 */
}
.rfcEditorRemove {
  position: relative;
  padding-top: 1.8em;
  background-color: #ffd; /* Arlen: WCAG 2019 */
  border-radius: 3px;
}
.cref {
  background-color: #ffd; /* Arlen: WCAG 2019 */
  padding: 2px 4px;
}
.crefSource {
  font-style: italic;
}
/* alternative layout for smaller screens */
@media screen and (max-width: 1023px) {
  body {
    padding-top: 2em;
  }
  #title {
    padding: 1em 0;
  }
  h1 {
    font-size: 24px;
  }
  h2 {
    font-size: 20px;
    margin-top: -18px;  /* provide offset for in-page anchors */
    padding-top: 38px;
  }
  #identifiers dd {
    max-width: 60%;
  }
  #toc {
    position: fixed;
    z-index: 2;
    top: 0;
    right: 0;
    padding: 0;
    margin: 0;
    background-color: inherit;
    border-bottom: 1px solid #ccc;
  }
  #toc h2 {
    margin: -1px 0 0 0;
    padding: 4px 0 4px 6px;
    padding-right: 1em;
    min-width: 190px;
    font-size: 1.1em;
    text-align: right;
    background-color: #444;
    color: white;
    cursor: pointer;
  }
  #toc h2::before { /* css hamburger */
    float: right;
    position: relative;
    width: 1em;
    height: 1px;
    left: -164px;
    margin: 6px 0 0 0;
    background: white none repeat scroll 0 0;
    box-shadow: 0 4px 0 0 white, 0 8px 0 0 white;
    content: "";
  }
  #toc nav {
    display: none;
    padding: 0.5em 1em 1em;
    overflow: auto;
    height: calc(100vh - 48px);
    border-left: 1px solid #ddd;
  }
}

/* alternative layout for wide screens */
@media screen and (min-width: 1024px) {
  body {
    max-width: 724px;
    margin: 42px auto;
    padding-left: 1.5em;
    padding-right: 29em;
  }
  #toc {
    position: fixed;
    top: 42px;
    right: 42px;
    width: 25%;
    margin: 0;
    padding: 0 1em;
    z-index: 1;
  }
  #toc h2 {
    border-top: none;
    border-bottom: 1px solid #ddd;
    font-size: 1em;
    font-weight: normal;
    margin: 0;
    padding: 0.25em 1em 1em 0;
  }
  #toc nav {
    display: block;
    height: calc(90vh - 84px);
    bottom: 0;
    padding: 0.5em 0 0;
    overflow: auto;
  }
  img { /* future proofing */
    max-width: 100%;
    height: auto;
  }
}

/* pagination */
@media print {
  body {

    width: 100%;
  }
  p {
    orphans: 3;
    widows: 3;
  }
  #n-copyright-notice {
    border-bottom: none;
  }
  #toc, #n-introduction {
    page-break-before: always;
  }
  #toc {
    border-top: none;
    padding-top: 0;
  }
  figure, pre {
    page-break-inside: avoid;
  }
  figure {
    overflow: scroll;
  }
  h1, h2, h3, h4, h5, h6 {
    page-break-after: avoid;
  }
  h2+*, h3+*, h4+*, h5+*, h6+* {
    page-break-before: avoid;
  }
  pre {
    white-space: pre-wrap;
    word-wrap: break-word;
    font-size: 10pt;
  }
  table {
    border: 1px solid #ddd;
  }
  td {
    border-top: 1px solid #ddd;
  }
}

/* This is commented out here, as the string-set: doesn't
   pass W3C validation currently */
/*
.ears thead .left {
  string-set: ears-top-left content();
}

.ears thead .center {
  string-set: ears-top-center content();
}

.ears thead .right {
  string-set: ears-top-right content();
}

.ears tfoot .left {
  string-set: ears-bottom-left content();
}

.ears tfoot .center {
  string-set: ears-bottom-center content();
}

.ears tfoot .right {
  string-set: ears-bottom-right content();
}
*/

@page :first {
  padding-top: 0;
  @top-left {
    content: normal;
    border: none;
  }
  @top-center {
    content: normal;
    border: none;
  }
  @top-right {
    content: normal;
    border: none;
  }
}

@page {
  size: A4;
  margin-bottom: 45mm;
  padding-top: 20px;
  /* The follwing is commented out here, but set appropriately by in code, as
     the content depends on the document */
  /*
  @top-left {
    content: 'Internet-Draft';
    vertical-align: bottom;
    border-bottom: solid 1px #ccc;
  }
  @top-left {
    content: string(ears-top-left);
    vertical-align: bottom;
    border-bottom: solid 1px #ccc;
  }
  @top-center {
    content: string(ears-top-center);
    vertical-align: bottom;
    border-bottom: solid 1px #ccc;
  }
  @top-right {
    content: string(ears-top-right);
    vertical-align: bottom;
    border-bottom: solid 1px #ccc;
  }
  @bottom-left {
    content: string(ears-bottom-left);
    vertical-align: top;
    border-top: solid 1px #ccc;
  }
  @bottom-center {
    content: string(ears-bottom-center);
    vertical-align: top;
    border-top: solid 1px #ccc;
  }
  @bottom-right {
      content: '[Page ' counter(page) ']';
      vertical-align: top;
      border-top: solid 1px #ccc;
  }
  */

}

/* Changes introduced to fix issues found during implementation */
/* Make sure links are clickable even if overlapped by following H* */
a {
  z-index: 2;
}
/* Separate body from document info even without intervening H1 */
section {
  clear: both;
}


/* Top align author divs, to avoid names without organization dropping level with org names */
.author {
  vertical-align: top;
}

/* Leave room in document info to show Internet-Draft on one line */
#identifiers dt {
  width: 8em;
}

/* Don't waste quite as much whitespace between label and value in doc info */
#identifiers dd {
  margin-left: 1em;
}

/* Give floating toc a background color (needed when it's a div inside section */
#toc {
  background-color: white;
}

/* Make the collapsed ToC header render white on gray also when it's a link */
@media screen and (max-width: 1023px) {
  #toc h2 a,
  #toc h2 a:link,
  #toc h2 a:focus,
  #toc h2 a:hover,
  #toc a.toplink,
  #toc a.toplink:hover {
    color: white;
    background-color: #444;
    text-decoration: none;
  }
}

/* Give the bottom of the ToC some whitespace */
@media screen and (min-width: 1024px) {
  #toc {
    padding: 0 0 1em 1em;
  }
}

/* Style section numbers with more space between number and title */
.section-number {
  padding-right: 0.5em;
}

/* prevent monospace from becoming overly large */
tt, code, pre, code {
  font-size: 95%;
}

/* Fix the height/width aspect for ascii art*/
pre.sourcecode,
.art-text pre {
  line-height: 1.12;
}


/* Add styling for a link in the ToC that points to the top of the document */
a.toplink {
  float: right;
  margin-right: 0.5em;
}

/* Fix the dl styling to match the RFC 7992 attributes */
dl > dt,
dl.dlParallel > dt {
  float: left;
  margin-right: 1em;
}
dl.dlNewline > dt {
  float: none;
}

/* Provide styling for table cell text alignment */
table td.text-left,
table th.text-left {
  text-align: left;
}
table td.text-center,
table th.text-center {
  text-align: center;
}
table td.text-right,
table th.text-right {
  text-align: right;
}

/* Make the alternative author contact informatio look less like just another
   author, and group it closer with the primary author contact information */
.alternative-contact {
  margin: 0.5em 0 0.25em 0;
}
address .non-ascii {
  margin: 0 0 0 2em;
}

/* With it being possible to set tables with alignment
  left, center, and right, { width: 100%; } does not make sense */
table {
  width: auto;
}

/* Avoid reference text that sits in a block with very wide left margin,
   because of a long floating dt label.*/
.references dd {
  overflow: visible;
}

/* Control caption placement */
caption {
  caption-side: bottom;
}

/* Limit the width of the author address vcard, so names in right-to-left
   script don't end up on the other side of the page. */

address.vcard {
  max-width: 30em;
  margin-right: auto;
}

/* For address alignment dependent on LTR or RTL scripts */
address div.left {
  text-align: left;
}
address div.right {
  text-align: right;
}

/* Provide table alignment support.  We can't use the alignX classes above
   since they do unwanted things with caption and other styling. */
table.right {
 margin-left: auto;
 margin-right: 0;
}
table.center {
 margin-left: auto;
 margin-right: auto;
}
table.left {
 margin-left: 0;
 margin-right: auto;
}

/* Give the table caption label the same styling as the figcaption */
caption a[href] {
  color: #222;
}

@media print {
  .toplink {
    display: none;
  }

  /* avoid overwriting the top border line with the ToC header */
  #toc {
    padding-top: 1px;
  }

  /* Avoid page breaks inside dl and author address entries */
  .vcard {
    page-break-inside: avoid;
  }

}
/* Tweak the bcp14 keyword presentation */
.bcp14 {
  font-variant: small-caps;
  font-weight: bold;
  font-size: 0.9em;
}
/* Tweak the invisible space above H* in order not to overlay links in text above */
 h2 {
  margin-top: -18px;  /* provide offset for in-page anchors */
  padding-top: 31px;
 }
 h3 {
  margin-top: -18px;  /* provide offset for in-page anchors */
  padding-top: 24px;
 }
 h4 {
  margin-top: -18px;  /* provide offset for in-page anchors */
  padding-top: 24px;
 }
/* Float artwork pilcrow to the right */
@media screen {
  .artwork a.pilcrow {
    display: block;
    line-height: 0.7;
    margin-top: 0.15em;
  }
}
/* Make pilcrows on dd visible */
@media screen {
  dd:hover > a.pilcrow {
    visibility: visible;
  }
}
/* Make the placement of figcaption match that of a table's caption
   by removing the figure's added bottom margin */
.alignLeft.art-text,
.alignCenter.art-text,
.alignRight.art-text {
   margin-bottom: 0;
}
.alignLeft,
.alignCenter,
.alignRight {
  margin: 1em 0 0 0;
}
/* In print, the pilcrow won't show on hover, so prevent it from taking up space,
   possibly even requiring a new line */
@media print {
  a.pilcrow {
    display: none;
  }
}
/* Styling for the external metadata */
div#external-metadata {
  background-color: #eee;
  padding: 0.5em;
  margin-bottom: 0.5em;
  display: none;
}
div#internal-metadata {
  padding: 0.5em;                       /* to match the external-metadata padding */
}
/* Styling for title RFC Number */
h1#rfcnum {
  clear: both;
  margin: 0 0 -1em;
  padding: 1em 0 0 0;
}
/* Make .olPercent look the same as <ol><li> */
dl.olPercent > dd {
  margin-bottom: 0.25em;
  min-height: initial;
}
/* Give aside some styling to set it apart */
aside {
  border-left: 1px solid #ddd;
  margin: 1em 0 1em 2em;
  padding: 0.2em 2em;
}
aside > dl,
aside > ol,
aside > ul,
aside > table,
aside > p {
  margin-bottom: 0.5em;
}
/* Additional page break settings */
@media print {
  figcaption, table caption {
    page-break-before: avoid;
  }
}
/* Font size adjustments for print */
@media print {
  body  { font-size: 10pt;      line-height: normal; max-width: 96%; }
  h1    { font-size: 1.72em;    padding-top: 1.5em; } /* 1*1.2*1.2*1.2 */
  h2    { font-size: 1.44em;    padding-top: 1.5em; } /* 1*1.2*1.2 */
  h3    { font-size: 1.2em;     padding-top: 1.5em; } /* 1*1.2 */
  h4    { font-size: 1em;       padding-top: 1.5em; }
  h5, h6 { font-size: 1em;      margin: initial; padding: 0.5em 0 0.3em; }
}
/* Sourcecode margin in print, when there's no pilcrow */
@media print {
  .artwork,
  .sourcecode {
    margin-bottom: 1em;
  }
}
/* Avoid narrow tables forcing too narrow table captions, which may render badly */
table {
  min-width: 20em;
}
/* ol type a */
ol.type-a { list-style-type: lower-alpha; }
ol.type-A { list-style-type: upper-alpha; }
ol.type-i { list-style-type: lower-roman; }
ol.type-I { list-style-type: lower-roman; }
/* Apply the print table and row borders in general, on request from the RPC,
and increase the contrast between border and odd row background sligthtly */
table {
  border: 1px solid #ddd;
}
td {
  border-top: 1px solid #ddd;
}
tr:nth-child(2n+1) > td {
  background-color: #f8f8f8;
}
/* Use style rules to govern display of the TOC. */
@media screen and (max-width: 1023px) {
  #toc nav { display: none; }
  #toc.active nav { display: block; }
}
/* Add support for keepWithNext */
.keepWithNext {
  break-after: avoid-page;
  break-after: avoid-page;
}
/* Add support for keepWithPrevious */
.keepWithPrevious {
  break-before: avoid-page;
}
/* Change the approach to avoiding breaks inside artwork etc. */
figure, pre, table, .artwork, .sourcecode  {
  break-before: avoid-page;
  break-after: auto;
}
/* Avoid breaks between <dt> and <dd> */
dl {
  break-before: auto;
  break-inside: auto;
}
dt {
  break-before: auto;
  break-after: avoid-page;
}
dd {
  break-before: avoid-page;
  break-after: auto;
  orphans: 3;
  widows: 3
}
span.break, dd.break {
  margin-bottom: 0;
  min-height: 0;
  break-before: auto;
  break-inside: auto;
  break-after: auto;
}
/* Undo break-before ToC */
@media print {
  #toc {
    break-before: auto;
  }
}
/* Text in compact lists should not get extra bottim margin space,
   since that would makes the list not compact */
ul.compact p, .ulCompact p,
ol.compact p, .olCompact p {
 margin: 0;
}
/* But the list as a whole needs the extra space at the end */
section ul.compact,
section .ulCompact,
section ol.compact,
section .olCompact {
  margin-bottom: 1em;                    /* same as p not within ul.compact etc. */
}
/* The tt and code background above interferes with for instance table cell
   backgrounds.  Changed to something a bit more selective. */
tt, code {
  background-color: transparent;
}
p tt, p code, li tt, li code {
  background-color: #f8f8f8;
}
/* Tweak the pre margin -- 0px doesn't come out well */
pre {
   margin-top: 0.5px;
}
/* Tweak the comact list text */
ul.compact, .ulCompact,
ol.compact, .olCompact,
dl.compact, .dlCompact {
  line-height: normal;
}
/* Don't add top margin for nested lists */
li > ul, li > ol, li > dl,
dd > ul, dd > ol, dd > dl,
dl > dd > dl {
  margin-top: initial;
}
/* Elements that should not be rendered on the same line as a <dt> */
/* This should match the element list in writer.text.TextWriter.render_dl() */
dd > div.artwork:first-child,
dd > aside:first-child,
dd > figure:first-child,
dd > ol:first-child,
dd > div:first-child > pre.sourcecode,
dd > table:first-child,
dd > ul:first-child {
  clear: left;
}
/* fix for weird browser behaviour when <dd/> is empty */
dt+dd:empty::before{
  content: "\00a0";
}
/* Make paragraph spacing inside <li> smaller than in body text, to fit better within the list */
li > p {
  margin-bottom: 0.5em
}
/* Don't let p margin spill out from inside list items */
li > p:last-of-type {
  margin-bottom: 0;
}
</style>
<link href="rfc-local.css" rel="stylesheet" type="text/css">
<link href="https://dx.doi.org/10.17487/rfc9115" rel="alternate">
  <link href="urn:issn:2070-1721" rel="alternate">
  <link href="https://datatracker.ietf.org/doc/draft-ietf-acme-star-delegation-09" rel="prev">
  </head>
<body>
<script src="https://www.rfc-editor.org/js/metadata.min.js"></script>
<table class="ears">
<thead><tr>
<td class="left">RFC 9115</td>
<td class="center">ACME Delegation</td>
<td class="right">September 2021</td>
</tr></thead>
<tfoot><tr>
<td class="left">Sheffer, et al.</td>
<td class="center">Standards Track</td>
<td class="right">[Page]</td>
</tr></tfoot>
</table>
<div id="external-metadata" class="document-information"></div>
<div id="internal-metadata" class="document-information">
<dl id="identifiers">
<dt class="label-stream">Stream:</dt>
<dd class="stream">Internet Engineering Task Force (IETF)</dd>
<dt class="label-rfc">RFC:</dt>
<dd class="rfc"><a href="https://www.rfc-editor.org/rfc/rfc9115" class="eref">9115</a></dd>
<dt class="label-category">Category:</dt>
<dd class="category">Standards Track</dd>
<dt class="label-published">Published:</dt>
<dd class="published">
<time datetime="2021-09" class="published">September 2021</time>
    </dd>
<dt class="label-issn">ISSN:</dt>
<dd class="issn">2070-1721</dd>
<dt class="label-authors">Authors:</dt>
<dd class="authors">
<div class="author">
      <div class="author-name">Y. Sheffer</div>
<div class="org">Intuit</div>
</div>
<div class="author">
      <div class="author-name">D. López</div>
<div class="org">Telefonica I+D</div>
</div>
<div class="author">
      <div class="author-name">A. Pastor Perales</div>
<div class="org">Telefonica I+D</div>
</div>
<div class="author">
      <div class="author-name">T. Fossati</div>
<div class="org">ARM</div>
</div>
</dd>
</dl>
</div>
<h1 id="rfcnum">RFC 9115</h1>
<h1 id="title">An Automatic Certificate Management Environment (ACME) Profile for Generating Delegated Certificates</h1>
<section id="section-abstract">
      <h2 id="abstract"><a href="#abstract" class="selfRef">Abstract</a></h2>
<p id="section-abstract-1">This document defines a profile of the Automatic Certificate Management Environment
(ACME) protocol by which the holder of an identifier (e.g., a domain name) can
allow a third party to obtain an X.509 certificate such that the certificate
subject is the delegated identifier while the certified public key corresponds
to a private key controlled by the third party.
A primary use case is that of a Content Delivery Network (CDN), the third party,
terminating TLS sessions on behalf of a content provider (the holder of a domain
name).  The presented mechanism allows the holder of the identifier to retain
control over the delegation and revoke it at any time.  Importantly, this
mechanism does not require any modification to the deployed TLS
clients and servers.<a href="#section-abstract-1" class="pilcrow">¶</a></p>
</section>
<div id="status-of-memo">
<section id="section-boilerplate.1">
        <h2 id="name-status-of-this-memo">
<a href="#name-status-of-this-memo" class="section-name selfRef">Status of This Memo</a>
        </h2>
<p id="section-boilerplate.1-1">
            This is an Internet Standards Track document.<a href="#section-boilerplate.1-1" class="pilcrow">¶</a></p>
<p id="section-boilerplate.1-2">
            This document is a product of the Internet Engineering Task Force
            (IETF).  It represents the consensus of the IETF community.  It has
            received public review and has been approved for publication by
            the Internet Engineering Steering Group (IESG).  Further
            information on Internet Standards is available in Section 2 of 
            RFC 7841.<a href="#section-boilerplate.1-2" class="pilcrow">¶</a></p>
<p id="section-boilerplate.1-3">
            Information about the current status of this document, any
            errata, and how to provide feedback on it may be obtained at
            <span><a href="https://www.rfc-editor.org/info/rfc9115">https://www.rfc-editor.org/info/rfc9115</a></span>.<a href="#section-boilerplate.1-3" class="pilcrow">¶</a></p>
</section>
</div>
<div id="copyright">
<section id="section-boilerplate.2">
        <h2 id="name-copyright-notice">
<a href="#name-copyright-notice" class="section-name selfRef">Copyright Notice</a>
        </h2>
<p id="section-boilerplate.2-1">
            Copyright (c) 2021 IETF Trust and the persons identified as the
            document authors. All rights reserved.<a href="#section-boilerplate.2-1" class="pilcrow">¶</a></p>
<p id="section-boilerplate.2-2">
            This document is subject to BCP 78 and the IETF Trust's Legal
            Provisions Relating to IETF Documents
            (<span><a href="https://trustee.ietf.org/license-info">https://trustee.ietf.org/license-info</a></span>) in effect on the date of
            publication of this document. Please review these documents
            carefully, as they describe your rights and restrictions with
            respect to this document. Code Components extracted from this
            document must include Simplified BSD License text as described in
            Section 4.e of the Trust Legal Provisions and are provided without
            warranty as described in the Simplified BSD License.<a href="#section-boilerplate.2-2" class="pilcrow">¶</a></p>
</section>
</div>
<div id="toc">
<section id="section-toc.1">
        <a href="#" onclick="scroll(0,0)" class="toplink">▲</a><h2 id="name-table-of-contents">
<a href="#name-table-of-contents" class="section-name selfRef">Table of Contents</a>
        </h2>
<nav class="toc"><ul class="ulBare ulEmpty toc compact">
<li class="ulBare ulEmpty toc compact" id="section-toc.1-1.1">
            <p id="section-toc.1-1.1.1" class="keepWithNext"><a href="#section-1" class="xref">1</a>.  <a href="#name-introduction" class="xref">Introduction</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.1.2.1">
                <p id="section-toc.1-1.1.2.1.1" class="keepWithNext"><a href="#section-1.1" class="xref">1.1</a>.  <a href="#name-terminology" class="xref">Terminology</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.1.2.2">
                <p id="section-toc.1-1.1.2.2.1" class="keepWithNext"><a href="#section-1.2" class="xref">1.2</a>.  <a href="#name-conventions-used-in-this-do" class="xref">Conventions Used in This Document</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.2">
            <p id="section-toc.1-1.2.1"><a href="#section-2" class="xref">2</a>.  <a href="#name-protocol-flow" class="xref">Protocol Flow</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.1">
                <p id="section-toc.1-1.2.2.1.1"><a href="#section-2.1" class="xref">2.1</a>.  <a href="#name-preconditions" class="xref">Preconditions</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.2">
                <p id="section-toc.1-1.2.2.2.1"><a href="#section-2.2" class="xref">2.2</a>.  <a href="#name-overview" class="xref">Overview</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3">
                <p id="section-toc.1-1.2.2.3.1"><a href="#section-2.3" class="xref">2.3</a>.  <a href="#name-delegated-identity-profile" class="xref">Delegated Identity Profile</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.1">
                    <p id="section-toc.1-1.2.2.3.2.1.1"><a href="#section-2.3.1" class="xref">2.3.1</a>.  <a href="#name-delegation-configuration" class="xref">Delegation Configuration</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.2">
                    <p id="section-toc.1-1.2.2.3.2.2.1"><a href="#section-2.3.2" class="xref">2.3.2</a>.  <a href="#name-order-object-transmitted-fr" class="xref">Order Object Transmitted from NDC to IdO and to ACME Server (STAR)</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.3">
                    <p id="section-toc.1-1.2.2.3.2.3.1"><a href="#section-2.3.3" class="xref">2.3.3</a>.  <a href="#name-order-object-transmitted-fro" class="xref">Order Object Transmitted from NDC to IdO and to ACME Server (Non-STAR)</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.4">
                    <p id="section-toc.1-1.2.2.3.2.4.1"><a href="#section-2.3.4" class="xref">2.3.4</a>.  <a href="#name-capability-discovery" class="xref">Capability Discovery</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.5">
                    <p id="section-toc.1-1.2.2.3.2.5.1"><a href="#section-2.3.5" class="xref">2.3.5</a>.  <a href="#name-negotiating-an-unauthentica" class="xref">Negotiating an Unauthenticated GET</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.3.2.6">
                    <p id="section-toc.1-1.2.2.3.2.6.1"><a href="#section-2.3.6" class="xref">2.3.6</a>.  <a href="#name-terminating-the-delegation" class="xref">Terminating the Delegation</a></p>
</li>
                </ul>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.2.2.4">
                <p id="section-toc.1-1.2.2.4.1"><a href="#section-2.4" class="xref">2.4</a>.  <a href="#name-proxy-behavior" class="xref">Proxy Behavior</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.3">
            <p id="section-toc.1-1.3.1"><a href="#section-3" class="xref">3</a>.  <a href="#name-ca-behavior" class="xref">CA Behavior</a></p>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.4">
            <p id="section-toc.1-1.4.1"><a href="#section-4" class="xref">4</a>.  <a href="#name-csr-template" class="xref">CSR Template</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.4.2.1">
                <p id="section-toc.1-1.4.2.1.1"><a href="#section-4.1" class="xref">4.1</a>.  <a href="#name-template-syntax" class="xref">Template Syntax</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.4.2.2">
                <p id="section-toc.1-1.4.2.2.1"><a href="#section-4.2" class="xref">4.2</a>.  <a href="#name-example" class="xref">Example</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.5">
            <p id="section-toc.1-1.5.1"><a href="#section-5" class="xref">5</a>.  <a href="#name-further-use-cases" class="xref">Further Use Cases</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.5.2.1">
                <p id="section-toc.1-1.5.2.1.1"><a href="#section-5.1" class="xref">5.1</a>.  <a href="#name-cdn-interconnection-cdni" class="xref">CDN Interconnection (CDNI)</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.5.2.1.2.1">
                    <p id="section-toc.1-1.5.2.1.2.1.1"><a href="#section-5.1.1" class="xref">5.1.1</a>.  <a href="#name-multiple-parallel-delegates" class="xref">Multiple Parallel Delegates</a></p>
</li>
                  <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.5.2.1.2.2">
                    <p id="section-toc.1-1.5.2.1.2.2.1"><a href="#section-5.1.2" class="xref">5.1.2</a>.  <a href="#name-chained-delegation" class="xref">Chained Delegation</a></p>
</li>
                </ul>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.5.2.2">
                <p id="section-toc.1-1.5.2.2.1"><a href="#section-5.2" class="xref">5.2</a>.  <a href="#name-secure-telephone-identity-r" class="xref">Secure Telephone Identity Revisited (STIR)</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.6">
            <p id="section-toc.1-1.6.1"><a href="#section-6" class="xref">6</a>.  <a href="#name-iana-considerations" class="xref">IANA Considerations</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.6.2.1">
                <p id="section-toc.1-1.6.2.1.1"><a href="#section-6.1" class="xref">6.1</a>.  <a href="#name-new-fields-in-the-meta-obje" class="xref">New Fields in the "meta" Object within a Directory Object</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.6.2.2">
                <p id="section-toc.1-1.6.2.2.1"><a href="#section-6.2" class="xref">6.2</a>.  <a href="#name-new-fields-in-the-order-obj" class="xref">New Fields in the Order Object</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.6.2.3">
                <p id="section-toc.1-1.6.2.3.1"><a href="#section-6.3" class="xref">6.3</a>.  <a href="#name-new-fields-in-the-account-o" class="xref">New Fields in the Account Object</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.6.2.4">
                <p id="section-toc.1-1.6.2.4.1"><a href="#section-6.4" class="xref">6.4</a>.  <a href="#name-new-error-types" class="xref">New Error Types</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.6.2.5">
                <p id="section-toc.1-1.6.2.5.1"><a href="#section-6.5" class="xref">6.5</a>.  <a href="#name-csr-template-extensions" class="xref">CSR Template Extensions</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.7">
            <p id="section-toc.1-1.7.1"><a href="#section-7" class="xref">7</a>.  <a href="#name-security-considerations" class="xref">Security Considerations</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.7.2.1">
                <p id="section-toc.1-1.7.2.1.1"><a href="#section-7.1" class="xref">7.1</a>.  <a href="#name-trust-model" class="xref">Trust Model</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.7.2.2">
                <p id="section-toc.1-1.7.2.2.1"><a href="#section-7.2" class="xref">7.2</a>.  <a href="#name-delegation-security-goal" class="xref">Delegation Security Goal</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.7.2.3">
                <p id="section-toc.1-1.7.2.3.1"><a href="#section-7.3" class="xref">7.3</a>.  <a href="#name-new-acme-channels" class="xref">New ACME Channels</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.7.2.4">
                <p id="section-toc.1-1.7.2.4.1"><a href="#section-7.4" class="xref">7.4</a>.  <a href="#name-restricting-cdns-to-the-del" class="xref">Restricting CDNs to the Delegation Mechanism</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.8">
            <p id="section-toc.1-1.8.1"><a href="#section-8" class="xref">8</a>.  <a href="#name-references" class="xref">References</a></p>
<ul class="ulBare compact ulEmpty toc">
<li class="ulBare compact ulEmpty toc" id="section-toc.1-1.8.2.1">
                <p id="section-toc.1-1.8.2.1.1"><a href="#section-8.1" class="xref">8.1</a>.  <a href="#name-normative-references" class="xref">Normative References</a></p>
</li>
              <li class="ulBare compact ulEmpty toc" id="section-toc.1-1.8.2.2">
                <p id="section-toc.1-1.8.2.2.1"><a href="#section-8.2" class="xref">8.2</a>.  <a href="#name-informative-references" class="xref">Informative References</a></p>
</li>
            </ul>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.9">
            <p id="section-toc.1-1.9.1"><a href="#appendix-A" class="xref">Appendix A</a>.  <a href="#name-csr-template-cddl" class="xref">CSR Template: CDDL</a></p>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.10">
            <p id="section-toc.1-1.10.1"><a href="#appendix-B" class="xref">Appendix B</a>.  <a href="#name-csr-template-json-schema" class="xref">CSR Template: JSON Schema</a></p>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.11">
            <p id="section-toc.1-1.11.1"><a href="#appendix-C" class="xref"></a><a href="#name-acknowledgements" class="xref">Acknowledgements</a></p>
</li>
          <li class="ulBare ulEmpty toc compact" id="section-toc.1-1.12">
            <p id="section-toc.1-1.12.1"><a href="#appendix-D" class="xref"></a><a href="#name-authors-addresses" class="xref">Authors' Addresses</a></p>
</li>
        </ul>
</nav>
</section>
</div>
<div id="introduction">
<section id="section-1">
      <h2 id="name-introduction">
<a href="#section-1" class="section-number selfRef">1. </a><a href="#name-introduction" class="section-name selfRef">Introduction</a>
      </h2>
<p id="section-1-1">This document is related to <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span>, in that some important use cases require both documents to be implemented. To avoid duplication,
we give here a bare-bones description of the motivation for this solution.  For
more details, please refer to the introductory sections
of <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span>.<a href="#section-1-1" class="pilcrow">¶</a></p>
<p id="section-1-2">An Identifier Owner (IdO) has agreements
in place with one or more Name Delegation Consumer (NDC) to use and attest its
identity.<a href="#section-1-2" class="pilcrow">¶</a></p>
<p id="section-1-3">In the primary use case, the IdO is a content provider, and we consider a Content Delivery Network (CDN) provider contracted to
serve the content over HTTPS.  The CDN terminates the HTTPS connection at
one of its edge cache servers and needs to present its clients (browsers,
mobile apps, set-top boxes) a certificate whose name matches the domain name of
the URL that is requested, i.e., that of the IdO.  Understandably, some IdOs may balk at sharing their long-term private keys with another organization;
equally, delegates would rather not have to handle other parties' long-term
secrets. Other relevant use cases are discussed in <a href="#further-use-cases" class="xref">Section 5</a>.<a href="#section-1-3" class="pilcrow">¶</a></p>
<p id="section-1-4">This document describes a profile of the ACME protocol <span>[<a href="#RFC8555" class="xref">RFC8555</a>]</span> that allows
the NDC to request from the IdO, acting as a profiled ACME server, a certificate for
a delegated identity -- i.e., one belonging to the IdO.  The IdO then uses the
ACME protocol (with the extensions described in <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span>) to request
issuance of a Short-Term, Automatically Renewed (STAR) certificate for the same delegated identity. The generated
short-term certificate is automatically renewed by the ACME Certification
Authority (CA), is periodically fetched by the NDC, and is used to terminate HTTPS
connections in lieu of the IdO.  The IdO can end the delegation at any time by
simply instructing the CA to stop the automatic renewal and letting the
certificate expire shortly thereafter.<a href="#section-1-4" class="pilcrow">¶</a></p>
<p id="section-1-5">While the primary use case we address is a delegation of STAR certificates, the
mechanism proposed here also accommodates long-lived certificates managed with
the ACME protocol. The most noticeable difference between long-lived and STAR
certificates is the way the termination of the delegation is managed.  In the
case of long-lived certificates, the IdO uses the <code>revokeCert</code> URL exposed by the
CA and waits for the explicit revocation based on the Certificate Revocation
List (CRL) and Online Certificate Status Protocol (OCSP) to propagate to the
relying parties.<a href="#section-1-5" class="pilcrow">¶</a></p>
<p id="section-1-6">In case the delegated identity is a domain name, this document also provides a
way for the NDC to inform the IdO about the CNAME mappings that need to be
installed in the IdO's DNS zone to enable the aliasing of the delegated name,
thus allowing the complete name delegation workflow to be handled using a
single interface.<a href="#section-1-6" class="pilcrow">¶</a></p>
<p id="section-1-7">We note that other standardization efforts address the problem of certificate delegation for TLS connections, specifically <span>[<a href="#I-D.ietf-tls-subcerts" class="xref">TLS-SUBCERTS</a>]</span> and <span>[<a href="#I-D.mglt-lurk-tls13" class="xref">MGLT-LURK-TLS13</a>]</span>. The former extends the TLS certificate chain with a customer-owned signing certificate; the latter separates the server's private key into a dedicated, more-secure component. Compared to these other approaches, the current document does not require changes to the TLS network stack of the client or the server, nor does it introduce additional latency to the TLS connection.<a href="#section-1-7" class="pilcrow">¶</a></p>
<div id="terminology">
<section id="section-1.1">
        <h3 id="name-terminology">
<a href="#section-1.1" class="section-number selfRef">1.1. </a><a href="#name-terminology" class="section-name selfRef">Terminology</a>
        </h3>
<span class="break"></span><dl class="dlParallel" id="section-1.1-1">
          <dt id="section-1.1-1.1">IdO</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.2">
            <p id="section-1.1-1.2.1">Identifier Owner, the holder (current owner) of an identifier (e.g., a domain
name) that needs to be delegated.  Depending on the context, the term IdO may
also be used to designate the (profiled) ACME server deployed by the Identifier
Owner or the ACME client used by the Identifier Owner to interact with the CA.<a href="#section-1.1-1.2.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.3">NDC</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.4">
            <p id="section-1.1-1.4.1">Name Delegation Consumer, the entity to which the domain name is
delegated for a limited time.  This is a CDN in the primary use
case (in fact, readers may note the similarity of the two
abbreviations).  Depending on the context, the term NDC may
also be used to designate the (profiled) ACME client used by the Name
Delegation Consumer.<a href="#section-1.1-1.4.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.5">CDN</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.6">
            <p id="section-1.1-1.6.1">Content Delivery Network, a widely distributed network that
serves the domain's web content to a wide audience at high
performance.<a href="#section-1.1-1.6.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.7">STAR</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.8">
            <p id="section-1.1-1.8.1">Short-Term, Automatically Renewed, as applied to X.509 certificates.<a href="#section-1.1-1.8.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.9">ACME</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.10">
            <p id="section-1.1-1.10.1">Automated Certificate Management Environment, a
certificate management protocol <span>[<a href="#RFC8555" class="xref">RFC8555</a>]</span>.<a href="#section-1.1-1.10.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.11">CA</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.12">
            <p id="section-1.1-1.12.1">Certification Authority, specifically one that implements the ACME protocol. In this document, the term is synonymous with "ACME server deployed by the Certification Authority".<a href="#section-1.1-1.12.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.13">CSR</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.14">
            <p id="section-1.1-1.14.1">Certificate Signing Request, specifically a PKCS#10 <span>[<a href="#RFC2986" class="xref">RFC2986</a>]</span> Certificate Signing Request, as supported by ACME.<a href="#section-1.1-1.14.1" class="pilcrow">¶</a></p>
</dd>
          <dd class="break"></dd>
<dt id="section-1.1-1.15">FQDN</dt>
          <dd style="margin-left: 4.0em" id="section-1.1-1.16">
            <p id="section-1.1-1.16.1">Fully Qualified Domain Name.<a href="#section-1.1-1.16.1" class="pilcrow">¶</a></p>
</dd>
        <dd class="break"></dd>
</dl>
</section>
</div>
<div id="conventions-used-in-this-document">
<section id="section-1.2">
        <h3 id="name-conventions-used-in-this-do">
<a href="#section-1.2" class="section-number selfRef">1.2. </a><a href="#name-conventions-used-in-this-do" class="section-name selfRef">Conventions Used in This Document</a>
        </h3>
<p id="section-1.2-1">
The key words "<span class="bcp14">MUST</span>", "<span class="bcp14">MUST NOT</span>", "<span class="bcp14">REQUIRED</span>", "<span class="bcp14">SHALL</span>", "<span class="bcp14">SHALL NOT</span>", "<span class="bcp14">SHOULD</span>", "<span class="bcp14">SHOULD NOT</span>", "<span class="bcp14">RECOMMENDED</span>", "<span class="bcp14">NOT RECOMMENDED</span>",
"<span class="bcp14">MAY</span>", and "<span class="bcp14">OPTIONAL</span>" in this document are to be interpreted as
described in BCP 14 <span>[<a href="#RFC2119" class="xref">RFC2119</a>]</span> <span>[<a href="#RFC8174" class="xref">RFC8174</a>]</span> when, and only when, they
appear in all capitals, as shown here.<a href="#section-1.2-1" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
<div id="sec-protocol-flow">
<section id="section-2">
      <h2 id="name-protocol-flow">
<a href="#section-2" class="section-number selfRef">2. </a><a href="#name-protocol-flow" class="section-name selfRef">Protocol Flow</a>
      </h2>
<p id="section-2-1">This section presents the protocol flow.  For completeness, we include the ACME
profile proposed in this document as well as the ACME STAR protocol described
in <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span>.<a href="#section-2-1" class="pilcrow">¶</a></p>
<div id="proto-preconditions">
<section id="section-2.1">
        <h3 id="name-preconditions">
<a href="#section-2.1" class="section-number selfRef">2.1. </a><a href="#name-preconditions" class="section-name selfRef">Preconditions</a>
        </h3>
<p id="section-2.1-1">The protocol assumes the following preconditions are met:<a href="#section-2.1-1" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.1-2.1">The IdO exposes an ACME server interface to the NDC(s) comprising the account
management interface.<a href="#section-2.1-2.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.1-2.2">The NDC has registered an ACME account with the IdO.<a href="#section-2.1-2.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.1-2.3">The NDC and IdO have agreed on a "CSR template" to use, including at a minimum:
subject name (e.g., <code>abc.ido.example</code>), requested algorithms and key
length, key usage, and extensions.  The NDC will use
this template for every CSR created under the same delegation.<a href="#section-2.1-2.3" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.1-2.4">The IdO has registered an ACME account with the Certification Authority (CA).<a href="#section-2.1-2.4" class="pilcrow">¶</a>
</li>
        </ul>
<p id="section-2.1-3">Note that even if the IdO implements the ACME server role, it is not acting as
a CA; in fact, from the point of view of the certificate issuance process, the
IdO only works as a "policing" forwarder of the NDC's key pair and is
responsible for completing the identity verification process towards the CA.<a href="#section-2.1-3" class="pilcrow">¶</a></p>
</section>
</div>
<div id="overview">
<section id="section-2.2">
        <h3 id="name-overview">
<a href="#section-2.2" class="section-number selfRef">2.2. </a><a href="#name-overview" class="section-name selfRef">Overview</a>
        </h3>
<p id="section-2.2-1">For clarity, the protocol overview presented here covers the main use case of this protocol,
namely delegation of STAR certificates. Protocol behavior for non-STAR certificates is similar,
and the detailed differences are listed in the following sections.<a href="#section-2.2-1" class="pilcrow">¶</a></p>
<p id="section-2.2-2">The interaction between the NDC and the IdO is governed by the profiled ACME
workflow detailed in <a href="#sec-profile" class="xref">Section 2.3</a>.  The interaction between the IdO and the
CA is ruled by ACME <span>[<a href="#RFC8555" class="xref">RFC8555</a>]</span>, ACME STAR <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span>, and any other ACME extension that
applies (e.g., <span>[<a href="#I-D.ietf-acme-authority-token-tnauthlist" class="xref">TOKEN-TNAUTHLIST</a>]</span> for Secure Telephone Identity Revisited (STIR)).<a href="#section-2.2-2" class="pilcrow">¶</a></p>
<p id="section-2.2-3">The outline of the combined protocol for STAR certificates is as follows (<a href="#fig-endtoend" class="xref">Figure 1</a>):<a href="#section-2.2-3" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.2-4.1">NDC sends an Order1 for the delegated identifier to IdO.<a href="#section-2.2-4.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.2">IdO creates an Order1 resource in state <code>ready</code> with a <code>finalize</code> URL.<a href="#section-2.2-4.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.3">NDC immediately sends a <code>finalize</code> request (which includes the CSR) to the IdO.<a href="#section-2.2-4.3" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.4">IdO verifies the CSR according to the agreed upon CSR template.<a href="#section-2.2-4.4" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.5">If the CSR verification fails, Order1 is moved to an <code>invalid</code> state and
everything stops.<a href="#section-2.2-4.5" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.6">If the CSR verification is successful, IdO moves Order1 to state
<code>processing</code> and sends a new Order2 (using its own account) for the delegated
identifier to the CA.<a href="#section-2.2-4.6" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.7">If the ACME STAR protocol fails, Order2 moves to <code>invalid</code>, and the same state
is reflected in Order1 (i.e., the NDC Order).<a href="#section-2.2-4.7" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-2.2-4.8">If the ACME STAR run is successful (i.e., Order2 is <code>valid</code>), IdO copies the
<code>star-certificate</code> URL from Order2 to Order1 and updates the Order1 state to
<code>valid</code>.<a href="#section-2.2-4.8" class="pilcrow">¶</a>
</li>
        </ul>
<p id="section-2.2-5">The NDC can now download, install, and use the short-term certificate bearing the name delegated by the IdO. The STAR certificate can be used until it expires, at which time the NDC is guaranteed to find a new certificate it can download, install, and use. This continues with subsequent certificates until either Order1 expires or the IdO decides to cancel the automatic renewal process with the CA.<a href="#section-2.2-5" class="pilcrow">¶</a></p>
<p id="section-2.2-6">Note that the interactive identifier authorization phase described in <span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-7.5" class="relref">Section 7.5</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span> is suppressed on the NDC-IdO side because the delegated
identity contained in the CSR presented to the IdO is validated against the
configured CSR template (<a href="#sec-csr-template-syntax" class="xref">Section 4.1</a>).  Therefore, the NDC
sends the <code>finalize</code> request, including the CSR, to the IdO immediately after
Order1 has been acknowledged.  The IdO <span class="bcp14">SHALL</span> buffer a (valid) CSR until the
Validation phase completes successfully.<a href="#section-2.2-6" class="pilcrow">¶</a></p>
<p id="section-2.2-7">Also note that the successful negotiation of the unauthenticated GET (<span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-3.4" class="relref">Section 3.4</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span>) is required in order to allow the NDC to access the
<code>star-certificate</code> URL on the CA.<a href="#section-2.2-7" class="pilcrow">¶</a></p>
<span id="name-end-to-end-star-delegation-"></span><div id="fig-endtoend">
<figure id="figure-1">
          <div id="section-2.2-8.1">
            <div class="artwork art-svg alignLeft" id="section-2.2-8.1.1">
<svg xmlns="http://www.w3.org/2000/svg" class="diagram" version="1.1" viewBox="0 0 720.0 841.0">
                <g transform="translate(8,16)">
                  <path d="M 16,16 L 56,16" fill="none" stroke="black"></path>
                  <path d="M 176,16 L 288,16" fill="none" stroke="black"></path>
                  <path d="M 408,16 L 448,16" fill="none" stroke="black"></path>
                  <path d="M 0,48 L 72,48" fill="none" stroke="black"></path>
                  <path d="M 160,48 L 232,48" fill="none" stroke="black"></path>
                  <path d="M 232,48 L 304,48" fill="none" stroke="black"></path>
                  <path d="M 392,48 L 464,48" fill="none" stroke="black"></path>
                  <path d="M 0,80 L 32,80" fill="none" stroke="black"></path>
                  <path d="M 32,80 L 72,80" fill="none" stroke="black"></path>
                  <path d="M 160,80 L 200,80" fill="none" stroke="black"></path>
                  <path d="M 200,80 L 232,80" fill="none" stroke="black"></path>
                  <path d="M 232,80 L 264,80" fill="none" stroke="black"></path>
                  <path d="M 264,80 L 304,80" fill="none" stroke="black"></path>
                  <path d="M 392,80 L 432,80" fill="none" stroke="black"></path>
                  <path d="M 432,80 L 464,80" fill="none" stroke="black"></path>
                  <path d="M 32,144 L 192,144" fill="none" stroke="black"></path>
                  <path d="M 32,272 L 192,272" fill="none" stroke="black"></path>
                  <path d="M 40,304 L 200,304" fill="none" stroke="black"></path>
                  <path d="M 264,320 L 424,320" fill="none" stroke="black"></path>
                  <path d="M 272,368 L 432,368" fill="none" stroke="black"></path>
                  <path d="M 264,416 L 424,416" fill="none" stroke="black"></path>
                  <path d="M 264,512 L 424,512" fill="none" stroke="black"></path>
                  <path d="M 272,544 L 432,544" fill="none" stroke="black"></path>
                  <path d="M 32,624 L 424,624" fill="none" stroke="black"></path>
                  <path d="M 40,656 L 432,656" fill="none" stroke="black"></path>
                  <path d="M 32,688 L 424,688" fill="none" stroke="black"></path>
                  <path d="M 40,720 L 432,720" fill="none" stroke="black"></path>
                  <path d="M 32,768 L 424,768" fill="none" stroke="black"></path>
                  <path d="M 40,800 L 432,800" fill="none" stroke="black"></path>
                  <path d="M 0,32 L 0,48" fill="none" stroke="black"></path>
                  <path d="M 0,48 L 0,80" fill="none" stroke="black"></path>
                  <path d="M 32,80 L 32,144" fill="none" stroke="black"></path>
                  <path d="M 32,144 L 32,272" fill="none" stroke="black"></path>
                  <path d="M 32,272 L 32,624" fill="none" stroke="black"></path>
                  <path d="M 32,624 L 32,688" fill="none" stroke="black"></path>
                  <path d="M 32,688 L 32,768" fill="none" stroke="black"></path>
                  <path d="M 32,768 L 32,800" fill="none" stroke="black"></path>
                  <path d="M 72,32 L 72,48" fill="none" stroke="black"></path>
                  <path d="M 72,48 L 72,80" fill="none" stroke="black"></path>
                  <path d="M 160,32 L 160,48" fill="none" stroke="black"></path>
                  <path d="M 160,48 L 160,80" fill="none" stroke="black"></path>
                  <path d="M 200,80 L 200,304" fill="none" stroke="black"></path>
                  <path d="M 200,304 L 200,576" fill="none" stroke="black"></path>
                  <path d="M 232,48 L 232,80" fill="none" stroke="black"></path>
                  <path d="M 264,80 L 264,320" fill="none" stroke="black"></path>
                  <path d="M 264,320 L 264,416" fill="none" stroke="black"></path>
                  <path d="M 264,416 L 264,512" fill="none" stroke="black"></path>
                  <path d="M 264,512 L 264,576" fill="none" stroke="black"></path>
                  <path d="M 304,32 L 304,48" fill="none" stroke="black"></path>
                  <path d="M 304,48 L 304,80" fill="none" stroke="black"></path>
                  <path d="M 392,32 L 392,48" fill="none" stroke="black"></path>
                  <path d="M 392,48 L 392,80" fill="none" stroke="black"></path>
                  <path d="M 432,80 L 432,368" fill="none" stroke="black"></path>
                  <path d="M 432,368 L 432,544" fill="none" stroke="black"></path>
                  <path d="M 432,544 L 432,656" fill="none" stroke="black"></path>
                  <path d="M 432,656 L 432,720" fill="none" stroke="black"></path>
                  <path d="M 432,720 L 432,800" fill="none" stroke="black"></path>
                  <path d="M 464,32 L 464,48" fill="none" stroke="black"></path>
                  <path d="M 464,48 L 464,80" fill="none" stroke="black"></path>
                  <polygon points="48.000000,304.000000 36.000000,298.399994 36.000000,309.600006" transform="rotate(180.000000, 40.000000, 304.000000)" fill="black"></polygon>
                  <polygon points="48.000000,656.000000 36.000000,650.400024 36.000000,661.599976" transform="rotate(180.000000, 40.000000, 656.000000)" fill="black"></polygon>
                  <polygon points="48.000000,720.000000 36.000000,714.400024 36.000000,725.599976" transform="rotate(180.000000, 40.000000, 720.000000)" fill="black"></polygon>
                  <polygon points="48.000000,800.000000 36.000000,794.400024 36.000000,805.599976" transform="rotate(180.000000, 40.000000, 800.000000)" fill="black"></polygon>
                  <polygon points="200.000000,144.000000 188.000000,138.399994 188.000000,149.600006" transform="rotate(0.000000, 192.000000, 144.000000)" fill="black"></polygon>
                  <polygon points="200.000000,272.000000 188.000000,266.399994 188.000000,277.600006" transform="rotate(0.000000, 192.000000, 272.000000)" fill="black"></polygon>
                  <polygon points="280.000000,368.000000 268.000000,362.399994 268.000000,373.600006" transform="rotate(180.000000, 272.000000, 368.000000)" fill="black"></polygon>
                  <polygon points="280.000000,544.000000 268.000000,538.400024 268.000000,549.599976" transform="rotate(180.000000, 272.000000, 544.000000)" fill="black"></polygon>
                  <polygon points="432.000000,320.000000 420.000000,314.399994 420.000000,325.600006" transform="rotate(0.000000, 424.000000, 320.000000)" fill="black"></polygon>
                  <polygon points="432.000000,416.000000 420.000000,410.399994 420.000000,421.600006" transform="rotate(0.000000, 424.000000, 416.000000)" fill="black"></polygon>
                  <polygon points="432.000000,512.000000 420.000000,506.399994 420.000000,517.599976" transform="rotate(0.000000, 424.000000, 512.000000)" fill="black"></polygon>
                  <polygon points="432.000000,624.000000 420.000000,618.400024 420.000000,629.599976" transform="rotate(0.000000, 424.000000, 624.000000)" fill="black"></polygon>
                  <polygon points="432.000000,688.000000 420.000000,682.400024 420.000000,693.599976" transform="rotate(0.000000, 424.000000, 688.000000)" fill="black"></polygon>
                  <polygon points="432.000000,768.000000 420.000000,762.400024 420.000000,773.599976" transform="rotate(0.000000, 424.000000, 768.000000)" fill="black"></polygon>
                  <path d="M 16,16 A 16,16 0 0,0 0,32" fill="none" stroke="black"></path>
                  <path d="M 56,16 A 16,16 0 0,1 72,32" fill="none" stroke="black"></path>
                  <path d="M 176,16 A 16,16 0 0,0 160,32" fill="none" stroke="black"></path>
                  <path d="M 288,16 A 16,16 0 0,1 304,32" fill="none" stroke="black"></path>
                  <path d="M 408,16 A 16,16 0 0,0 392,32" fill="none" stroke="black"></path>
                  <path d="M 448,16 A 16,16 0 0,1 464,32" fill="none" stroke="black"></path>
                  <circle cx="32" cy="144" r="6" fill="white" stroke="black"></circle>
                  <circle cx="32" cy="272" r="6" fill="white" stroke="black"></circle>
                  <circle cx="32" cy="624" r="6" fill="white" stroke="black"></circle>
                  <circle cx="32" cy="688" r="6" fill="white" stroke="black"></circle>
                  <circle cx="32" cy="768" r="6" fill="white" stroke="black"></circle>
                  <circle cx="200" cy="304" r="6" fill="white" stroke="black"></circle>
                  <circle cx="264" cy="320" r="6" fill="white" stroke="black"></circle>
                  <circle cx="264" cy="416" r="6" fill="white" stroke="black"></circle>
                  <circle cx="264" cy="512" r="6" fill="white" stroke="black"></circle>
                  <circle cx="432" cy="368" r="6" fill="white" stroke="black"></circle>
                  <circle cx="432" cy="544" r="6" fill="white" stroke="black"></circle>
                  <circle cx="432" cy="656" r="6" fill="white" stroke="black"></circle>
                  <circle cx="432" cy="720" r="6" fill="white" stroke="black"></circle>
                  <circle cx="432" cy="800" r="6" fill="white" stroke="black"></circle>
                  <text text-anchor="middle" font-family="monospace" x="184" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="212" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="404" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="532" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="788" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="36" fill="black" font-size="1em">I</text>
                  <text text-anchor="middle" font-family="monospace" x="248" y="68" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="212" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="484" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="580" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="40" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="676" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="644" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="308" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="356" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="532" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="580" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="612" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="756" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="132" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="612" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="676" fill="black" font-size="1em">)</text>
                  <text text-anchor="middle" font-family="monospace" x="248" y="708" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="24" y="36" fill="black" font-size="1em">N</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="68" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="440" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="292" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="500" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="532" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="676" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="756" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="68" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="180" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="212" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="356" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="452" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="612" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="676" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="416" y="36" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="676" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="756" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="532" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="292" fill="black" font-size="1em">w</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="340" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="532" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="532" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="260" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="404" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="500" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="612" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="756" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="756" fill="black" font-size="1em">G</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="416" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="676" fill="black" font-size="1em">G</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="756" fill="black" font-size="1em">(</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="212" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="612" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="644" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="676" fill="black" font-size="1em">(</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="676" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="756" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="180" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="356" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="388" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="500" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="612" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="612" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="676" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="292" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="408" y="532" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="676" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="756" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="212" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="180" fill="black" font-size="1em">y</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="196" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="260" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="452" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="580" fill="black" font-size="1em">&gt;</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="180" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="356" fill="black" font-size="1em">z</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="580" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="676" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="756" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="788" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="448" y="68" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="212" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="388" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="676" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="676" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="676" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="68" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="212" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="292" fill="black" font-size="1em">k</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="388" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="404" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="644" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="708" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="756" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="116" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="308" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="340" fill="black" font-size="1em">q</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="500" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="580" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="612" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="32" y="36" fill="black" font-size="1em">D</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="212" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="260" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="260" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="356" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="580" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="644" fill="black" font-size="1em">#</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="756" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="196" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="248" y="788" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="484" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="676" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="740" fill="black" font-size="1em">.</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="756" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="196" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="212" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="400" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="612" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="676" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="788" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="180" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="196" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="212" fill="black" font-size="1em">z</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="580" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="756" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="788" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="116" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="180" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="292" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="452" fill="black" font-size="1em">&lt;</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="612" fill="black" font-size="1em">(</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="612" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="756" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="40" y="36" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="388" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="500" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="676" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="260" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="404" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="532" fill="black" font-size="1em">w</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="532" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="612" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="788" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="292" fill="black" font-size="1em">m</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="452" fill="black" font-size="1em">V</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="676" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="756" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="404" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="416" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="580" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="580" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="612" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="676" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="756" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="416" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="212" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="244" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="452" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="612" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="424" y="36" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="212" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="260" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="356" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="404" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="580" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="612" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="612" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="196" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="756" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="708" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="196" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="196" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="244" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="388" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="452" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="580" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="580" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="180" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="644" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="400" y="340" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="612" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="116" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="612" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="248" y="644" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="580" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="260" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="292" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="340" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="580" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="180" fill="black" font-size="1em">N</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="132" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="180" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="308" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="356" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="580" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="676" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="676" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="16" y="68" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="756" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="708" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="308" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="388" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="452" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="424" y="452" fill="black" font-size="1em">&gt;</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="580" fill="black" font-size="1em">-</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="580" fill="black" font-size="1em">&lt;</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="676" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="180" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="244" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="292" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="340" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="404" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="40" y="580" fill="black" font-size="1em">&lt;</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="708" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="196" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="68" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="356" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="676" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="68" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="32" y="68" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="116" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="132" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="500" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="756" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="440" y="36" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="388" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="408" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="676" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="676" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="740" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="68" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="132" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="196" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="532" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="580" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="580" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="788" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="116" fill="black" font-size="1em">O</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="788" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="580" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="580" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="676" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="708" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="756" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="756" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="388" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="196" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="196" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="340" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="24" y="68" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="196" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="400" y="356" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="612" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="708" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="756" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="196" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="260" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="612" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="612" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="612" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="676" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="212" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="756" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="408" y="68" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="132" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="308" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="308" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="340" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="612" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="676" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="68" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="708" fill="black" font-size="1em">#</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="676" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="356" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="612" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="676" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="788" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="116" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="132" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="132" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="292" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="644" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="740" fill="black" font-size="1em">.</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="756" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="68" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="292" fill="black" font-size="1em">O</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="308" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="500" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="580" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="644" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="676" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="356" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="292" fill="black" font-size="1em">2</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="532" fill="black" font-size="1em">m</text>
                  <text text-anchor="middle" font-family="monospace" x="400" y="580" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="644" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="756" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="212" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="452" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="500" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="212" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="212" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="452" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="612" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="612" fill="black" font-size="1em">)</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="708" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="756" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="180" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="532" fill="black" font-size="1em">k</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="580" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="432" y="68" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="132" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="196" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="292" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="452" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="708" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="756" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="36" fill="black" font-size="1em">O</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="756" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="180" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="292" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="408" y="580" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="612" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="612" fill="black" font-size="1em">G</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="612" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="676" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="68" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="756" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="404" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="580" fill="black" font-size="1em">w</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="580" fill="black" font-size="1em">w</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="756" fill="black" font-size="1em">)</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="356" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="424" y="68" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="196" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="452" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="612" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="676" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="740" fill="black" font-size="1em">.</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="36" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="788" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="756" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="132" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="356" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="580" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="580" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="612" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="644" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="676" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="432" y="36" fill="black" font-size="1em">M</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="676" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="260" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="580" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="612" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="612" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="644" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="708" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="708" fill="black" font-size="1em">2</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="68" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="484" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="532" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="644" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="708" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="404" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="400" y="532" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="788" fill="black" font-size="1em">#</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="388" fill="black" font-size="1em">p</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="308" fill="black" font-size="1em">g</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="308" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="340" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="500" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="612" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="612" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="756" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="788" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="756" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="356" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="452" fill="black" font-size="1em">~</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="532" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="424" y="580" fill="black" font-size="1em">&gt;</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="644" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="740" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="756" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="788" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="756" fill="black" font-size="1em">f</text>
                </g>
              </svg><a href="#section-2.2-8.1.1" class="pilcrow">¶</a>
</div>
</div>
<figcaption><a href="#figure-1" class="selfRef">Figure 1</a>:
<a href="#name-end-to-end-star-delegation-" class="selfRef">End-to-End STAR Delegation Flow</a>
          </figcaption></figure>
</div>
</section>
</div>
<div id="sec-profile">
<section id="section-2.3">
        <h3 id="name-delegated-identity-profile">
<a href="#section-2.3" class="section-number selfRef">2.3. </a><a href="#name-delegated-identity-profile" class="section-name selfRef">Delegated Identity Profile</a>
        </h3>
<p id="section-2.3-1">This section defines a profile of the ACME protocol to be used between the NDC
and IdO.<a href="#section-2.3-1" class="pilcrow">¶</a></p>
<div id="sec-profile-dele-config">
<section id="section-2.3.1">
          <h4 id="name-delegation-configuration">
<a href="#section-2.3.1" class="section-number selfRef">2.3.1. </a><a href="#name-delegation-configuration" class="section-name selfRef">Delegation Configuration</a>
          </h4>
<p id="section-2.3.1-1">The IdO must be preconfigured to recognize one or more NDCs and present them with
details about certificate delegations that apply to each one.<a href="#section-2.3.1-1" class="pilcrow">¶</a></p>
<div id="account-object-extensions">
<section id="section-2.3.1.1">
            <h5 id="name-account-object-extensions">
<a href="#section-2.3.1.1" class="section-number selfRef">2.3.1.1. </a><a href="#name-account-object-extensions" class="section-name selfRef">Account Object Extensions</a>
            </h5>
<p id="section-2.3.1.1-1">An NDC identifies itself to the IdO as an ACME account.  The IdO can delegate
multiple names to an NDC, and these configurations are described through
<code>delegation</code> objects associated with the NDC's account object on the IdO.<a href="#section-2.3.1.1-1" class="pilcrow">¶</a></p>
<p id="section-2.3.1.1-2">As shown in <a href="#fig-account-object" class="xref">Figure 2</a>, the ACME account resource on the IdO is
extended with a new <code>delegations</code> attribute:<a href="#section-2.3.1.1-2" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlParallel" id="section-2.3.1.1-3">
              <dt id="section-2.3.1.1-3.1">delegations (required, string):</dt>
              <dd style="margin-left: 1.5em" id="section-2.3.1.1-3.2">A URL from which a list of delegations
configured for this account (<a href="#sec-delegation-objects" class="xref">Section 2.3.1.3</a>) can be fetched via a
POST-as-GET request.<a href="#section-2.3.1.1-3.2" class="pilcrow">¶</a>
</dd>
            <dd class="break"></dd>
</dl>
<span id="name-example-account-object-with"></span><div id="fig-account-object">
<figure id="figure-2">
              <div class="artwork art-text alignLeft" id="section-2.3.1.1-4.1">
<pre>
{
  "status": "valid",
  "contact": [
    "mailto:delegation-admin@ido.example"
  ],
  "termsOfServiceAgreed": true,
  "orders": "https://example.com/acme/orders/saHpfB",
  "delegations": "https://acme.ido.example/acme/delegations/adFqoz"
}
</pre>
</div>
<figcaption><a href="#figure-2" class="selfRef">Figure 2</a>:
<a href="#name-example-account-object-with" class="selfRef">Example Account Object with Delegations</a>
              </figcaption></figure>
</div>
</section>
</div>
<div id="delegation-lists">
<section id="section-2.3.1.2">
            <h5 id="name-delegation-lists">
<a href="#section-2.3.1.2" class="section-number selfRef">2.3.1.2. </a><a href="#name-delegation-lists" class="section-name selfRef">Delegation Lists</a>
            </h5>
<p id="section-2.3.1.2-1">Each account object includes a <code>delegations</code> URL from which a list of
delegation configurations created by the IdO can be fetched via a POST-as-GET
request.  The result of the request <span class="bcp14">MUST</span> be a JSON object whose <code>delegations</code>
field is an array of URLs, each identifying a delegation configuration made
available to the NDC account (<a href="#sec-delegation-objects" class="xref">Section 2.3.1.3</a>).  The server <span class="bcp14">MAY</span>
return an incomplete list, along with a <code>Link</code> header field with a <code>next</code> link
relation indicating where further entries can be acquired.<a href="#section-2.3.1.2-1" class="pilcrow">¶</a></p>
<div id="section-2.3.1.2-2">
<pre class="sourcecode lang-json">
HTTP/1.1 200 OK
Content-Type: application/json
Link: &lt;https://acme.ido.example/acme/directory&gt;;rel="index"
Link: &lt;https://acme.ido.example/acme/delegations/adFqoz?/
      cursor=2&gt;;rel="next"

{
  "delegations": [
    "https://acme.ido.example/acme/delegation/ogfr8EcolOT",
    "https://acme.ido.example/acme/delegation/wSi5Lbb61E4",
    /* more URLs not shown for example brevity */
    "https://acme.ido.example/acme/delegation/gm0wfLYHBen"
  ]
}

</pre><a href="#section-2.3.1.2-2" class="pilcrow">¶</a>
</div>
<p id="section-2.3.1.2-3">Note that in the figure above, https://acme.ido.example/acme/delegations/adFqoz?cursor=2 includes a line break
for the sake of presentation.<a href="#section-2.3.1.2-3" class="pilcrow">¶</a></p>
</section>
</div>
<div id="sec-delegation-objects">
<section id="section-2.3.1.3">
            <h5 id="name-delegation-objects">
<a href="#section-2.3.1.3" class="section-number selfRef">2.3.1.3. </a><a href="#name-delegation-objects" class="section-name selfRef">Delegation Objects</a>
            </h5>
<p id="section-2.3.1.3-1">This profile extends the ACME resource model with a new read-only <code>delegation</code>
object that represents a delegation configuration that applies to a given NDC.<a href="#section-2.3.1.3-1" class="pilcrow">¶</a></p>
<p id="section-2.3.1.3-2">A <code>delegation</code> object contains the CSR template (see <a href="#sec-csr-template" class="xref">Section 4</a>) that
applies to that delegation and, optionally, any related CNAME mapping for the
delegated identifiers.  Its structure is as follows:<a href="#section-2.3.1.3-2" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlParallel" id="section-2.3.1.3-3">
              <dt id="section-2.3.1.3-3.1">csr-template (required, object):</dt>
              <dd style="margin-left: 1.5em" id="section-2.3.1.3-3.2">CSR template, as defined in
<a href="#sec-csr-template" class="xref">Section 4</a>.<a href="#section-2.3.1.3-3.2" class="pilcrow">¶</a>
</dd>
              <dd class="break"></dd>
<dt id="section-2.3.1.3-3.3">cname-map (optional, object):</dt>
              <dd style="margin-left: 1.5em" id="section-2.3.1.3-3.4">A map of FQDN pairs.  In each pair, the name is
the delegated identifier; the value is the corresponding NDC name that is
aliased in the IdO's zone file to redirect the resolvers to the delegated
entity.  Both names and values <span class="bcp14">MUST</span> be FQDNs with a terminating '.'.
This field is only meaningful for identifiers of type <code>dns</code>.<a href="#section-2.3.1.3-3.4" class="pilcrow">¶</a>
</dd>
            <dd class="break"></dd>
</dl>
<p id="section-2.3.1.3-4">An example <code>delegation</code> object in JSON format is shown in
<a href="#fig-configuration-object" class="xref">Figure 3</a>.<a href="#section-2.3.1.3-4" class="pilcrow">¶</a></p>
<span id="name-example-delegation-configur"></span><div id="fig-configuration-object">
<figure id="figure-3">
              <div id="section-2.3.1.3-5.1">
<pre class="sourcecode lang-json">
{
  "csr-template": {
    "keyTypes": [
      {
        "PublicKeyType": "id-ecPublicKey",
        "namedCurve": "secp256r1",
        "SignatureType": "ecdsa-with-SHA256"
      }
    ],
    "subject": {
      "country": "CA",
      "stateOrProvince": "**",
      "locality": "**"
    },
    "extensions": {
      "subjectAltName": {
        "DNS": [
          "abc.ido.example"
        ]
      },
      "keyUsage": [
        "digitalSignature"
      ],
      "extendedKeyUsage": [
        "serverAuth"
      ]
    }
  },
  "cname-map": {
    "abc.ido.example.": "abc.ndc.example."
  }
}

</pre>
</div>
<figcaption><a href="#figure-3" class="selfRef">Figure 3</a>:
<a href="#name-example-delegation-configur" class="selfRef">Example Delegation Configuration Object</a>
              </figcaption></figure>
</div>
<p id="section-2.3.1.3-6">In order to indicate which specific delegation applies to the requested
certificate, a new <code>delegation</code> attribute is added to the
order object on the NDC-IdO side (see Figures <a href="#fig-star-ndc-neworder" class="xref">4</a>
and <a href="#fig-non-star-ndc-neworder" class="xref">7</a>).  The
value of this attribute is the URL pointing to the delegation configuration
object that is to be used for this certificate request.  If the <code>delegation</code>
attribute in the order object contains a URL that does not correspond to a
configuration available to the requesting ACME account, the IdO <span class="bcp14">MUST</span> return an error
response with status code 403 (Forbidden), providing a problem document
<span>[<a href="#RFC7807" class="xref">RFC7807</a>]</span> with type <code>urn:ietf:params:acme:error:unknownDelegation</code>.<a href="#section-2.3.1.3-6" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
<div id="sec-profile-star-order-journey">
<section id="section-2.3.2">
          <h4 id="name-order-object-transmitted-fr">
<a href="#section-2.3.2" class="section-number selfRef">2.3.2. </a><a href="#name-order-object-transmitted-fr" class="section-name selfRef">Order Object Transmitted from NDC to IdO and to ACME Server (STAR)</a>
          </h4>
<p id="section-2.3.2-1">If the delegation is for a STAR certificate, the request object created by the
NDC:<a href="#section-2.3.2-1" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.2-2.1">
              <span class="bcp14">MUST</span> have a <code>delegation</code> attribute indicating the preconfigured delegation
that applies to this Order;<a href="#section-2.3.2-2.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-2.2">
              <span class="bcp14">MUST</span> have entries in the <code>identifiers</code> field for each delegated name
present in the configuration;<a href="#section-2.3.2-2.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-2.3">
              <span class="bcp14">MUST NOT</span> contain the <code>notBefore</code> and <code>notAfter</code> fields; and<a href="#section-2.3.2-2.3" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-2.4">
              <span class="bcp14">MUST</span> contain an <code>auto-renewal</code> object and, inside it, the fields
listed in <span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-3.1.1" class="relref">Section 3.1.1</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span>.  In particular, the
<code>allow-certificate-get</code> attribute <span class="bcp14">MUST</span> be present and set to true.<a href="#section-2.3.2-2.4" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-new-star-order-from-ndc"></span><div id="fig-star-ndc-neworder">
<figure id="figure-4">
            <div id="section-2.3.2-3.1">
<pre class="sourcecode lang-json">
POST /acme/new-order HTTP/1.1
Host: acme.ido.example
Content-Type: application/jose+json

{
  "protected": base64url({
    "alg": "ES256",
    "kid": "https://acme.ido.example/acme/acct/evOfKhNU60wg",
    "nonce": "Alc00Ap6Rt7GMkEl3L1JX5",
    "url": "https://acme.ido.example/acme/new-order"
  }),
  "payload": base64url({
    "identifiers": [
      {
        "type": "dns",
        "value": "abc.ido.example"
      }
    ],
    "auto-renewal": {
      "end-date": "2021-04-20T00:00:00Z",
      "lifetime": 345600,          // 4 days
      "allow-certificate-get": true
    },
    "delegation":
      "https://acme.ido.example/acme/delegation/gm0wfLYHBen"
  }),
  "signature": "g454e3hdBlkT4AEw...nKePnUyZTjGtXZ6H"
}

</pre>
</div>
<figcaption><a href="#figure-4" class="selfRef">Figure 4</a>:
<a href="#name-new-star-order-from-ndc" class="selfRef">New STAR Order from NDC</a>
            </figcaption></figure>
</div>
<p id="section-2.3.2-4">The order object that is created on the IdO:<a href="#section-2.3.2-4" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.2-5.1">
              <span class="bcp14">MUST</span> start in the <code>ready</code> state;<a href="#section-2.3.2-5.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-5.2">
              <span class="bcp14">MUST</span> contain an <code>authorizations</code> array with zero elements;<a href="#section-2.3.2-5.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-5.3">
              <span class="bcp14">MUST</span> contain the indicated <code>delegation</code> configuration;<a href="#section-2.3.2-5.3" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-5.4">
              <span class="bcp14">MUST</span> contain the indicated <code>auto-renewal</code> settings; and<a href="#section-2.3.2-5.4" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-5.5">
              <span class="bcp14">MUST NOT</span> contain the <code>notBefore</code> and <code>notAfter</code> fields.<a href="#section-2.3.2-5.5" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-star-order-resource-created"></span><div id="fig-star-ido-order-resource-created">
<figure id="figure-5">
            <div id="section-2.3.2-6.1">
<pre class="sourcecode lang-json">
{
  "status": "ready",
  "expires": "2021-05-01T00:00:00Z",

  "identifiers": [
   {
     "type": "dns",
     "value": "abc.ido.example"
   }
  ],

  "auto-renewal": {
    "end-date": "2021-04-20T00:00:00Z",
    "lifetime": 345600,
    "allow-certificate-get": true
  },

  "delegation":
    "https://acme.ido.example/acme/delegation/gm0wfLYHBen",

  "authorizations": [],

  "finalize": "https://acme.ido.example/acme/order/TO8rfgo/finalize"
}

</pre>
</div>
<figcaption><a href="#figure-5" class="selfRef">Figure 5</a>:
<a href="#name-star-order-resource-created" class="selfRef">STAR Order Resource Created on IdO</a>
            </figcaption></figure>
</div>
<p id="section-2.3.2-7">The Order is then finalized by the NDC supplying the CSR containing the
delegated identifiers.  The IdO checks the provided CSR against the template
contained in the <code>delegation</code> object that applies to this request, as described in
<a href="#sec-csr-template-syntax" class="xref">Section 4.1</a>.  If the CSR fails validation for any of the
identifiers, the IdO <span class="bcp14">MUST</span> return an error response with status code 403
(Forbidden) and an appropriate type, e.g., <code>rejectedIdentifier</code> or <code>badCSR</code>.
The error response <span class="bcp14">SHOULD</span> contain subproblems (<span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-6.7.1" class="relref">Section 6.7.1</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span>)
for each failed identifier.  If the CSR is successfully validated, the order
object status moves to <code>processing</code> and the twin ACME protocol instance is
initiated on the IdO-CA side.<a href="#section-2.3.2-7" class="pilcrow">¶</a></p>
<p id="section-2.3.2-8">The request object created by the IdO:<a href="#section-2.3.2-8" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.2-9.1">
              <span class="bcp14">MUST</span> copy the identifiers sent by the NDC;<a href="#section-2.3.2-9.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-9.2">
              <span class="bcp14">MUST</span> strip the <code>delegation</code> attribute; and<a href="#section-2.3.2-9.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-9.3">
              <span class="bcp14">MUST</span> carry a copy of the <code>auto-renewal</code> object sent by the NDC.<a href="#section-2.3.2-9.3" class="pilcrow">¶</a>
</li>
          </ul>
<p id="section-2.3.2-10">When the identifiers' authorization has been successfully completed and the
certificate has been issued by the CA, the IdO:<a href="#section-2.3.2-10" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.2-11.1">
              <span class="bcp14">MUST</span> move its Order resource status to <code>valid</code> and<a href="#section-2.3.2-11.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.2-11.2">
              <span class="bcp14">MUST</span> copy the <code>star-certificate</code> field from the STAR Order returned by the CA
into its Order resource.  When dereferenced, the <code>star-certificate</code> URL
includes (via the <code>Cert-Not-Before</code> and <code>Cert-Not-After</code> HTTP header fields) the renewal timers
needed by the NDC to inform its certificate reload logic.<a href="#section-2.3.2-11.2" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-star-order-resource-updated"></span><div id="fig-star-ido-order-resource-updated">
<figure id="figure-6">
            <div id="section-2.3.2-12.1">
<pre class="sourcecode lang-json">
{
  "status": "valid",
  "expires": "2021-05-01T00:00:00Z",

  "identifiers": [
   {
     "type": "dns",
     "value": "abc.ido.example"
   }
  ],

  "auto-renewal": {
    "end-date": "2021-04-20T00:00:00Z",
    "lifetime": 345600,
    "allow-certificate-get": true
  },

  "delegation":
    "https://acme.ido.example/acme/delegation/gm0wfLYHBen",

  "authorizations": [],

  "finalize": "https://acme.ido.example/acme/order/TO8rfgo/finalize",

  "star-certificate": "https://acme.ca.example/acme/order/yTr23sSDg9"
}

</pre>
</div>
<figcaption><a href="#figure-6" class="selfRef">Figure 6</a>:
<a href="#name-star-order-resource-updated" class="selfRef">STAR Order Resource Updated on IdO</a>
            </figcaption></figure>
</div>
<p id="section-2.3.2-13">This delegation protocol is predicated on the NDC being able to fetch
certificates periodically using an unauthenticated HTTP GET, since, in general,
the NDC does not possess an account on the CA; as a consequence, it cannot issue the
standard POST-as-GET ACME request. Therefore, before forwarding the Order
request to the CA, the IdO <span class="bcp14">SHOULD</span> ensure that the selected CA supports
unauthenticated GET by inspecting the relevant settings in the CA's
directory object, as per <span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-3.4" class="relref">Section 3.4</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span>.  If the CA does not
support unauthenticated GET of STAR certificates, the IdO <span class="bcp14">MUST NOT</span> forward
the Order request.  Instead, it <span class="bcp14">MUST</span> move the Order status to <code>invalid</code> and set
the <code>allow-certificate-get</code> in the <code>auto-renewal</code> object to <code>false</code>.  The same
occurs in case the Order request is forwarded and the CA does not reflect the
<code>allow-certificate-get</code> setting in its Order resource.  The combination of
<code>invalid</code> status and denied <code>allow-certificate-get</code> in the Order resource at
the IdO provides an unambiguous (asynchronous) signal to the NDC about the
failure reason.<a href="#section-2.3.2-13" class="pilcrow">¶</a></p>
<div id="sec-cname-installation">
<section id="section-2.3.2.1">
            <h5 id="name-cname-installation">
<a href="#section-2.3.2.1" class="section-number selfRef">2.3.2.1. </a><a href="#name-cname-installation" class="section-name selfRef">CNAME Installation</a>
            </h5>
<p id="section-2.3.2.1-1">If one of the objects in the <code>identifiers</code> list is of type <code>dns</code>, the IdO can add the
CNAME records specified in the <code>delegation</code> object to its zone, for example:<a href="#section-2.3.2.1-1" class="pilcrow">¶</a></p>
<div class="artwork art-text alignLeft" id="section-2.3.2.1-2">
<pre>
   abc.ido.example. CNAME abc.ndc.example.
</pre><a href="#section-2.3.2.1-2" class="pilcrow">¶</a>
</div>
</section>
</div>
</section>
</div>
<div id="sec-profile-non-star-order-journey">
<section id="section-2.3.3">
          <h4 id="name-order-object-transmitted-fro">
<a href="#section-2.3.3" class="section-number selfRef">2.3.3. </a><a href="#name-order-object-transmitted-fro" class="section-name selfRef">Order Object Transmitted from NDC to IdO and to ACME Server (Non-STAR)</a>
          </h4>
<p id="section-2.3.3-1">If the delegation is for a non-STAR certificate, the request object created by
the NDC:<a href="#section-2.3.3-1" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.3-2.1">
              <span class="bcp14">MUST</span> have a <code>delegation</code> attribute indicating the preconfigured delegation
that applies to this Order;<a href="#section-2.3.3-2.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-2.2">
              <span class="bcp14">MUST</span> have entries in the <code>identifiers</code> field for each delegated name
present in the configuration; and<a href="#section-2.3.3-2.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-2.3">
              <span class="bcp14">MUST</span> have the <code>allow-certificate-get</code> attribute set to true.<a href="#section-2.3.3-2.3" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-new-non-star-order-from-ndc"></span><div id="fig-non-star-ndc-neworder">
<figure id="figure-7">
            <div id="section-2.3.3-3.1">
<pre class="sourcecode lang-json">
POST /acme/new-order HTTP/1.1
Host: acme.ido.example
Content-Type: application/jose+json

{
  "protected": base64url({
    "alg": "ES256",
    "kid": "https://acme.ido.example/acme/acct/evOfKhNU60wg",
    "nonce": "IYBkoQfaCS80UcCn9qH8Gt",
    "url": "https://acme.ido.example/acme/new-order"
  }),
  "payload": base64url({
    "identifiers": [
      {
        "type": "dns",
        "value": "abc.ido.example"
      }
    ],
    "delegation":
      "https://acme.ido.example/acme/delegation/gm0wfLYHBen",
    "allow-certificate-get": true
  }),
  "signature": "j9JBUvMigi4zodud...acYkEKaa8gqWyZ6H"
}

</pre>
</div>
<figcaption><a href="#figure-7" class="selfRef">Figure 7</a>:
<a href="#name-new-non-star-order-from-ndc" class="selfRef">New Non-STAR Order from NDC</a>
            </figcaption></figure>
</div>
<p id="section-2.3.3-4">The order object that is created on the IdO:<a href="#section-2.3.3-4" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.3-5.1">
              <span class="bcp14">MUST</span> start in the <code>ready</code> state;<a href="#section-2.3.3-5.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-5.2">
              <span class="bcp14">MUST</span> contain an <code>authorizations</code> array with zero elements;<a href="#section-2.3.3-5.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-5.3">
              <span class="bcp14">MUST</span> contain the indicated <code>delegation</code> configuration; and<a href="#section-2.3.3-5.3" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-5.4">
              <span class="bcp14">MUST</span> contain the indicated <code>allow-certificate-get</code> setting.<a href="#section-2.3.3-5.4" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-non-star-order-resource-cre"></span><div id="fig-non-star-ido-order-resource-created">
<figure id="figure-8">
            <div id="section-2.3.3-6.1">
<pre class="sourcecode lang-json">
{
  "status": "ready",
  "expires": "2021-05-01T00:00:00Z",

  "identifiers": [
   {
     "type": "dns",
     "value": "abc.ido.example"
   }
  ],

  "delegation":
    "https://acme.ido.example/acme/delegation/gm0wfLYHBen",

  "allow-certificate-get": true,

  "authorizations": [],

  "finalize": "https://acme.ido.example/acme/order/3ZDlhYy/finalize"
}

</pre>
</div>
<figcaption><a href="#figure-8" class="selfRef">Figure 8</a>:
<a href="#name-non-star-order-resource-cre" class="selfRef">Non-STAR Order Resource Created on IdO</a>
            </figcaption></figure>
</div>
<p id="section-2.3.3-7">The Order finalization by the NDC and the subsequent validation of the CSR by
the IdO proceed in the same way as for the STAR case.  If the CSR is
successfully validated, the order object status moves to <code>processing</code> and the
twin ACME protocol instance is initiated on the IdO-CA side.<a href="#section-2.3.3-7" class="pilcrow">¶</a></p>
<p id="section-2.3.3-8">The request object created by the IdO:<a href="#section-2.3.3-8" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.3-9.1">
              <span class="bcp14">MUST</span> copy the identifiers sent by the NDC;<a href="#section-2.3.3-9.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-9.2">
              <span class="bcp14">MUST</span> strip the <code>delegation</code> attribute; and<a href="#section-2.3.3-9.2" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-9.3">
              <span class="bcp14">MUST</span> copy the <code>allow-certificate-get</code> attribute.<a href="#section-2.3.3-9.3" class="pilcrow">¶</a>
</li>
          </ul>
<p id="section-2.3.3-10">When the identifiers' authorization has been successfully completed and the
certificate has been issued by the CA, the IdO:<a href="#section-2.3.3-10" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-2.3.3-11.1">
              <span class="bcp14">MUST</span> move its Order resource status to <code>valid</code> and<a href="#section-2.3.3-11.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-2.3.3-11.2">
              <span class="bcp14">MUST</span> copy the <code>certificate</code> field from the Order returned by the CA into its
Order resource, as well as <code>notBefore</code> and <code>notAfter</code> if these fields exist.<a href="#section-2.3.3-11.2" class="pilcrow">¶</a>
</li>
          </ul>
<span id="name-non-star-order-resource-upd"></span><div id="fig-non-star-ido-order-resource-updated">
<figure id="figure-9">
            <div id="section-2.3.3-12.1">
<pre class="sourcecode lang-json">
{
  "status": "valid",
  "expires": "2021-05-01T00:00:00Z",

  "identifiers": [
   {
     "type": "dns",
     "value": "abc.ido.example"
   }
  ],

  "delegation":
    "https://acme.ido.example/acme/delegation/gm0wfLYHBen",

  "allow-certificate-get": true,

  "authorizations": [],

  "finalize": "https://acme.ido.example/acme/order/3ZDlhYy/finalize",

  "certificate": "https://acme.ca.example/acme/order/YtR23SsdG9"
}

</pre>
</div>
<figcaption><a href="#figure-9" class="selfRef">Figure 9</a>:
<a href="#name-non-star-order-resource-upd" class="selfRef">Non-STAR Order Resource Updated on IdO</a>
            </figcaption></figure>
</div>
<p id="section-2.3.3-13">At this point of the protocol flow, the same considerations as in
<a href="#sec-cname-installation" class="xref">Section 2.3.2.1</a> apply.<a href="#section-2.3.3-13" class="pilcrow">¶</a></p>
<p id="section-2.3.3-14">Before forwarding the Order request to the CA, the IdO <span class="bcp14">SHOULD</span> ensure that the
selected CA supports unauthenticated GET by inspecting the relevant settings
in the CA's directory object, as per <a href="#sec-nego-allow-cert-get" class="xref">Section 2.3.5</a>.  If the CA
does not support unauthenticated GET of certificate resources, the IdO <span class="bcp14">MUST NOT</span> forward the Order request.  Instead, it <span class="bcp14">MUST</span> move the Order status to
<code>invalid</code> and set the <code>allow-certificate-get</code> attribute to <code>false</code>.  The same
occurs in case the Order request is forwarded and the CA does not reflect the
<code>allow-certificate-get</code> setting in its Order resource.  The combination of
<code>invalid</code> status and denied <code>allow-certificate-get</code> in the Order resource at
the IdO provides an unambiguous (asynchronous) signal to the NDC about the
failure reason.<a href="#section-2.3.3-14" class="pilcrow">¶</a></p>
</section>
</div>
<div id="capability-discovery">
<section id="section-2.3.4">
          <h4 id="name-capability-discovery">
<a href="#section-2.3.4" class="section-number selfRef">2.3.4. </a><a href="#name-capability-discovery" class="section-name selfRef">Capability Discovery</a>
          </h4>
<p id="section-2.3.4-1">In order to help a client discover support for this profile, the directory
object of an ACME server (typically, one deployed by the IdO) contains the
following attribute in the <code>meta</code> field:<a href="#section-2.3.4-1" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlParallel dlCompact" id="section-2.3.4-2">
            <dt id="section-2.3.4-2.1">delegation-enabled (optional, boolean):</dt>
            <dd style="margin-left: 1.5em" id="section-2.3.4-2.2">Boolean flag indicating support for
the profile specified in this memo.  An ACME server that supports this
delegation profile <span class="bcp14">MUST</span> include this key and <span class="bcp14">MUST</span> set it to true.<a href="#section-2.3.4-2.2" class="pilcrow">¶</a>
</dd>
          <dd class="break"></dd>
</dl>
<p id="section-2.3.4-3">The IdO <span class="bcp14">MUST</span> declare its support for delegation using <code>delegation-enabled</code>
regardless of whether it supports delegation of STAR certificates, non-STAR
certificates, or both.<a href="#section-2.3.4-3" class="pilcrow">¶</a></p>
<p id="section-2.3.4-4">In order to help a client discover support for certificate fetching using
unauthenticated HTTP GET, the directory object of an ACME server (typically,
one deployed by the CA) contains the following attribute in the <code>meta</code> field:<a href="#section-2.3.4-4" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlParallel dlCompact" id="section-2.3.4-5">
            <dt id="section-2.3.4-5.1">allow-certificate-get (optional, boolean):</dt>
            <dd style="margin-left: 1.5em" id="section-2.3.4-5.2">See <a href="#sec-nego-allow-cert-get" class="xref">Section 2.3.5</a>.<a href="#section-2.3.4-5.2" class="pilcrow">¶</a>
</dd>
          <dd class="break"></dd>
</dl>
</section>
</div>
<div id="sec-nego-allow-cert-get">
<section id="section-2.3.5">
          <h4 id="name-negotiating-an-unauthentica">
<a href="#section-2.3.5" class="section-number selfRef">2.3.5. </a><a href="#name-negotiating-an-unauthentica" class="section-name selfRef">Negotiating an Unauthenticated GET</a>
          </h4>
<p id="section-2.3.5-1">In order to enable the name delegation of non-STAR certificates, this document
defines a mechanism that allows a server to advertise support for accessing
certificate resources via unauthenticated GET (in addition to
POST-as-GET) and a client to enable this service with per-Order granularity.<a href="#section-2.3.5-1" class="pilcrow">¶</a></p>
<p id="section-2.3.5-2">It is worth pointing out that the protocol elements described in this section
have the same names and semantics as those introduced in
<span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-3.4" class="relref">Section 3.4</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span> for the STAR use case (except, of course, they apply to the
certificate resource rather than the star-certificate resource).  However, they
differ in terms of their position in the directory meta and order objects;
rather than being wrapped in an <code>auto-renewal</code> subobject, they are located at the
top level.<a href="#section-2.3.5-2" class="pilcrow">¶</a></p>
<div id="capability-metadata">
<p id="section-2.3.5-3">A server states its availability to grant unauthenticated access to a client's
Order certificate by setting the <code>allow-certificate-get</code> attribute to <code>true</code> in
   the <code>meta</code> field inside the directory object:<a href="#section-2.3.5-3" class="pilcrow">¶</a></p>
</div>
<span class="break"></span><dl class="dlParallel dlCompact" id="section-2.3.5-4">
            <dt id="section-2.3.5-4.1">allow-certificate-get (optional, boolean):</dt>
            <dd style="margin-left: 1.5em" id="section-2.3.5-4.2">If this field is present and set
to <code>true</code>, the server allows GET (and HEAD) requests to certificate URLs.<a href="#section-2.3.5-4.2" class="pilcrow">¶</a>
</dd>
          <dd class="break"></dd>
</dl>
<p id="section-2.3.5-5">A client states its desire to access the issued certificate via unauthenticated
GET by adding an <code>allow-certificate-get</code> attribute to the payload of its
newOrder request and setting it to <code>true</code>.<a href="#section-2.3.5-5" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlParallel dlCompact" id="section-2.3.5-6">
            <dt id="section-2.3.5-6.1">allow-certificate-get (optional, boolean):</dt>
            <dd style="margin-left: 1.5em" id="section-2.3.5-6.2">If this field is present and set
to <code>true</code>, the client requests the server to allow unauthenticated GET (and
HEAD) to the certificate associated with this Order.<a href="#section-2.3.5-6.2" class="pilcrow">¶</a>
</dd>
          <dd class="break"></dd>
</dl>
<p id="section-2.3.5-7">If the server accepts the request, it <span class="bcp14">MUST</span> reflect the attribute setting in the
resulting order object.<a href="#section-2.3.5-7" class="pilcrow">¶</a></p>
<p id="section-2.3.5-8">Note that even when the use of unauthenticated GET has been agreed upon, the
server <span class="bcp14">MUST</span> also allow POST-as-GET requests to the certificate resource.<a href="#section-2.3.5-8" class="pilcrow">¶</a></p>
</section>
</div>
<div id="terminating-the-delegation">
<section id="section-2.3.6">
          <h4 id="name-terminating-the-delegation">
<a href="#section-2.3.6" class="section-number selfRef">2.3.6. </a><a href="#name-terminating-the-delegation" class="section-name selfRef">Terminating the Delegation</a>
          </h4>
<p id="section-2.3.6-1">Identity delegation is terminated differently depending on whether or not this is a STAR certificate.<a href="#section-2.3.6-1" class="pilcrow">¶</a></p>
<div id="by-cancellation-star">
<section id="section-2.3.6.1">
            <h5 id="name-by-cancellation-star">
<a href="#section-2.3.6.1" class="section-number selfRef">2.3.6.1. </a><a href="#name-by-cancellation-star" class="section-name selfRef">By Cancellation (STAR)</a>
            </h5>
<p id="section-2.3.6.1-1">The IdO can terminate the delegation of a STAR certificate by requesting its
cancellation (see <span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-3.1.2" class="relref">Section 3.1.2</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span>).<a href="#section-2.3.6.1-1" class="pilcrow">¶</a></p>
<p id="section-2.3.6.1-2">Cancellation of the ACME STAR certificate is a
prerogative of the IdO.  The NDC does not own the relevant account key on the
CA; therefore, it can't issue a cancellation request for the STAR certificate.
Potentially, since it holds the STAR certificate's private key, it could request the
revocation of a single STAR certificate.  However, STAR explicitly disables the
revokeCert interface.<a href="#section-2.3.6.1-2" class="pilcrow">¶</a></p>
<p id="section-2.3.6.1-3">Shortly after the automatic renewal process is stopped by the IdO, the last
issued STAR certificate expires and the delegation terminates.<a href="#section-2.3.6.1-3" class="pilcrow">¶</a></p>
</section>
</div>
<div id="by-revocation-non-star">
<section id="section-2.3.6.2">
            <h5 id="name-by-revocation-non-star">
<a href="#section-2.3.6.2" class="section-number selfRef">2.3.6.2. </a><a href="#name-by-revocation-non-star" class="section-name selfRef">By Revocation (Non-STAR)</a>
            </h5>
<p id="section-2.3.6.2-1">The IdO can terminate the delegation of a non-STAR certificate by requesting it
to be revoked using the <code>revokeCert</code> URL exposed by the CA.<a href="#section-2.3.6.2-1" class="pilcrow">¶</a></p>
<p id="section-2.3.6.2-2">According to <span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-7.6" class="relref">Section 7.6</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span>, the revocation endpoint can be used
with either the account key pair or the certificate key pair. In other words, an
NDC that learns the <code>revokeCert</code> URL of the CA (which is publicly available via
the CA's directory object) would be able to revoke the certificate using the
associated private key. However, given the trust relationship between the NDC and
IdO expected by the delegation trust model (<a href="#sec-trust-model" class="xref">Section 7.1</a>), as well as
the lack of incentives for the NDC to prematurely terminate the delegation,
this does not represent a significant security risk.<a href="#section-2.3.6.2-2" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
</section>
</div>
<div id="proxy-behavior">
<section id="section-2.4">
        <h3 id="name-proxy-behavior">
<a href="#section-2.4" class="section-number selfRef">2.4. </a><a href="#name-proxy-behavior" class="section-name selfRef">Proxy Behavior</a>
        </h3>
<p id="section-2.4-1">There are cases where the ACME Delegation flow should be proxied, such as the
use case described in <a href="#sec-cdni-dele" class="xref">Section 5.1.2</a>. This section describes the behavior of
such proxies.<a href="#section-2.4-1" class="pilcrow">¶</a></p>
<p id="section-2.4-2">An entity implementing the IdO server role -- an "ACME Delegation server" --
may behave, on a per-identity case, either as a proxy into another ACME Delegation
server or as an IdO and obtain a certificate directly.
The determining factor is whether it can successfully be authorized by
the next-hop ACME server for the identity associated with the certificate request.<a href="#section-2.4-2" class="pilcrow">¶</a></p>
<p id="section-2.4-3">The identities supported by each server and the disposition for each of them
are preconfigured.<a href="#section-2.4-3" class="pilcrow">¶</a></p>
<p id="section-2.4-4">Following is the proxy's behavior for each of the messages exchanged in the
ACME Delegation process:<a href="#section-2.4-4" class="pilcrow">¶</a></p>
<span class="break"></span><dl class="dlNewline dlCompact" id="section-2.4-5">
          <dt id="section-2.4-5.1">New-order request:</dt>
          <dd style="margin-left: 1.5em" id="section-2.4-5.2">
            <ul class="compact">
<li class="compact" id="section-2.4-5.2.1.1">The complete <code>identifiers</code> attribute <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.2.1.1" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.2.1.2">Similarly, the <code>auto-renewal</code> object <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.2.1.2" class="pilcrow">¶</a>
</li>
            </ul>
</dd>
          <dd class="break"></dd>
<dt id="section-2.4-5.3">New-order response:</dt>
          <dd style="margin-left: 1.5em" id="section-2.4-5.4">
            <ul class="compact">
<li class="compact" id="section-2.4-5.4.1.1">The <code>status</code>, <code>expires</code>, <code>authorizations</code>, <code>identifiers</code>, and <code>auto-renewal</code>
attributes/objects <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.4.1.1" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.4.1.2">The <code>finalize</code> URL is rewritten so that the <code>finalize</code> request will be
made to the proxy.<a href="#section-2.4-5.4.1.2" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.4.1.3">Similarly, the <code>Location</code> header <span class="bcp14">MUST</span> be rewritten to point to an order object on the proxy.<a href="#section-2.4-5.4.1.3" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.4.1.4">Any <code>Link</code> relations <span class="bcp14">MUST</span> be rewritten to point to the proxy.<a href="#section-2.4-5.4.1.4" class="pilcrow">¶</a>
</li>
            </ul>
</dd>
          <dd class="break"></dd>
<dt id="section-2.4-5.5">Get Order response:</dt>
          <dd style="margin-left: 1.5em" id="section-2.4-5.6">
            <ul class="compact">
<li class="compact" id="section-2.4-5.6.1.1">The <code>status</code>, <code>expires</code>, <code>authorizations</code>, <code>identifiers</code>, and <code>auto-renewal</code>
attributes/objects <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.6.1.1" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.6.1.2">Similarly, the <code>star-certificate</code> URL (or the <code>certificate</code> URL in case of
non-STAR requests) <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.6.1.2" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.6.1.3">The <code>finalize</code> URL is rewritten so that the <code>finalize</code> request will be
made to the proxy.<a href="#section-2.4-5.6.1.3" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.6.1.4">The <code>Location</code> header <span class="bcp14">MUST</span> be rewritten to point to an order object on the proxy.<a href="#section-2.4-5.6.1.4" class="pilcrow">¶</a>
</li>
              <li class="compact" id="section-2.4-5.6.1.5">Any <code>Link</code> relations <span class="bcp14">MUST</span> be rewritten to point to the proxy.<a href="#section-2.4-5.6.1.5" class="pilcrow">¶</a>
</li>
            </ul>
</dd>
          <dd class="break"></dd>
<dt id="section-2.4-5.7">
<code>finalize</code> request:</dt>
          <dd style="margin-left: 1.5em" id="section-2.4-5.8">
            <ul class="compact">
<li class="compact" id="section-2.4-5.8.1.1">The CSR <span class="bcp14">MUST</span> be copied as is.<a href="#section-2.4-5.8.1.1" class="pilcrow">¶</a>
</li>
            </ul>
</dd>
          <dd class="break"></dd>
<dt id="section-2.4-5.9">
<code>finalize</code> response:</dt>
          <dd style="margin-left: 1.5em" id="section-2.4-5.10">
            <ul class="compact">
<li class="compact" id="section-2.4-5.10.1.1">The <code>Location</code> header, <code>Link</code> relations, and the <code>finalize</code> URLs are rewritten as for Get Order.<a href="#section-2.4-5.10.1.1" class="pilcrow">¶</a>
</li>
            </ul>
</dd>
        <dd class="break"></dd>
</dl>
<p id="section-2.4-6">We note that all the above messages are authenticated; therefore, each proxy
must be able to authenticate any subordinate server.<a href="#section-2.4-6" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
<div id="sec-ca-behavior">
<section id="section-3">
      <h2 id="name-ca-behavior">
<a href="#section-3" class="section-number selfRef">3. </a><a href="#name-ca-behavior" class="section-name selfRef">CA Behavior</a>
      </h2>
<p id="section-3-1">Although most of this document, and in particular <a href="#sec-protocol-flow" class="xref">Section 2</a>, is focused on the protocol between the NDC and IdO, the protocol does affect the ACME server running in the CA. A CA that wishes to support certificate delegation <span class="bcp14">MUST</span> also support unauthenticated certificate fetching, which it declares using <code>allow-certificate-get</code> (<a href="#capability-metadata" class="xref">Section 2.3.5, Paragraph 3</a>).<a href="#section-3-1" class="pilcrow">¶</a></p>
</section>
</div>
<div id="sec-csr-template">
<section id="section-4">
      <h2 id="name-csr-template">
<a href="#section-4" class="section-number selfRef">4. </a><a href="#name-csr-template" class="section-name selfRef">CSR Template</a>
      </h2>
<p id="section-4-1">The CSR template is used to express and constrain the shape of the CSR that the
NDC uses to request the certificate.  The CSR is used for every certificate
created under the same delegation.  Its validation by the IdO is a critical
element in the security of the whole delegation mechanism.<a href="#section-4-1" class="pilcrow">¶</a></p>
<p id="section-4-2">Instead of defining every possible CSR attribute, this document takes a
minimalist approach by declaring only the minimum attribute set and deferring
the registration of further, more-specific attributes to future documents.<a href="#section-4-2" class="pilcrow">¶</a></p>
<div id="sec-csr-template-syntax">
<section id="section-4.1">
        <h3 id="name-template-syntax">
<a href="#section-4.1" class="section-number selfRef">4.1. </a><a href="#name-template-syntax" class="section-name selfRef">Template Syntax</a>
        </h3>
<p id="section-4.1-1">The template is a JSON document. Each field (with the exception of <code>keyTypes</code>, see below) denotes one of the following:<a href="#section-4.1-1" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-4.1-2.1">A mandatory field where the template specifies the literal value of that
field. This is denoted by a literal string, such as <code>abc.ido.example</code>.<a href="#section-4.1-2.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-4.1-2.2">A mandatory field where the content of the field is defined by the client.
This is denoted by <code>**</code>.<a href="#section-4.1-2.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-4.1-2.3">An optional field where the client decides whether the field is included in
the CSR and, if so, what its value is. This is denoted by <code>*</code>.<a href="#section-4.1-2.3" class="pilcrow">¶</a>
</li>
        </ul>
<p id="section-4.1-3">The NDC <span class="bcp14">MUST NOT</span> include any fields in the CSR, including any extensions, unless they are specified in the
template.<a href="#section-4.1-3" class="pilcrow">¶</a></p>
<p id="section-4.1-4">The structure of the template object is defined by the Concise Data Definition Language (CDDL) <span>[<a href="#RFC8610" class="xref">RFC8610</a>]</span> document in <a href="#csr-template-schema-cddl" class="xref">Appendix A</a>.
An alternative, nonnormative JSON Schema syntax is given in <a href="#csr-template-schema" class="xref">Appendix B</a>.
While the CSR template must follow the syntax defined here, neither the IdO nor
the NDC are expected to validate it at runtime.<a href="#section-4.1-4" class="pilcrow">¶</a></p>
<p id="section-4.1-5">The <code>subject</code> field and its subfields are mapped into the <code>subject</code> field of the CSR, as per <span><a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.1.2.6" class="relref">Section 4.1.2.6</a> of [<a href="#RFC5280" class="xref">RFC5280</a>]</span>. Other extension fields of the CSR template are mapped into the CSR according to the table in <a href="#csr-template-registry" class="xref">Section 6.5</a>.<a href="#section-4.1-5" class="pilcrow">¶</a></p>
<p id="section-4.1-6">The <code>subjectAltName</code> field is currently defined for the following identifiers:
DNS names, email addresses, and URIs.  New identifier types may be added in the
future by documents that extend this specification.  Each new identifier type
<span class="bcp14">SHALL</span> have an associated identifier validation challenge that the CA can
use to obtain proof of the requester's control over it.<a href="#section-4.1-6" class="pilcrow">¶</a></p>
<p id="section-4.1-7">The <code>keyTypes</code> property is not copied into the CSR. Instead, this property constrains the <code>SubjectPublicKeyInfo</code> field of the CSR, which <span class="bcp14">MUST</span> have the type/size defined by one of the array members of the <code>keyTypes</code> property.<a href="#section-4.1-7" class="pilcrow">¶</a></p>
<p id="section-4.1-8">When the IdO receives the CSR, it <span class="bcp14">MUST</span> verify that the CSR is consistent
with the template contained in the <code>delegation</code> object referenced in the Order. The IdO <span class="bcp14">MAY</span> enforce additional
constraints, e.g., by restricting field lengths.  In this regard, note that a
<code>subjectAltName</code> of type <code>DNS</code> can be specified using the wildcard notation,
meaning that the NDC can be required (<code>**</code>) or offered the possibility (<code>*</code>) to
define the delegated domain name by itself.  If this is the case, the IdO <span class="bcp14">MUST</span>
apply application-specific checks on top of the control rules already provided
by the CSR template to ensure the requested domain name is legitimate according
to its local policy.<a href="#section-4.1-8" class="pilcrow">¶</a></p>
</section>
</div>
<div id="example">
<section id="section-4.2">
        <h3 id="name-example">
<a href="#section-4.2" class="section-number selfRef">4.2. </a><a href="#name-example" class="section-name selfRef">Example</a>
        </h3>
<p id="section-4.2-1">The CSR template in <a href="#fig-csr-template" class="xref">Figure 10</a> represents one possible CSR template
governing the delegation exchanges provided in the rest of this document.<a href="#section-4.2-1" class="pilcrow">¶</a></p>
<span id="name-example-csr-template"></span><div id="fig-csr-template">
<figure id="figure-10">
          <div id="section-4.2-2.1">
<pre class="sourcecode lang-json">
{
  "keyTypes": [
    {
      "PublicKeyType": "rsaEncryption",
      "PublicKeyLength": 2048,
      "SignatureType": "sha256WithRSAEncryption"
    },
    {
      "PublicKeyType": "id-ecPublicKey",
      "namedCurve": "secp256r1",
      "SignatureType": "ecdsa-with-SHA256"
    }
  ],
  "subject": {
    "country": "CA",
    "stateOrProvince": "**",
    "locality": "**"
  },
  "extensions": {
    "subjectAltName": {
      "DNS": [
        "abc.ido.example"
      ]
    },
    "keyUsage": [
      "digitalSignature"
    ],
    "extendedKeyUsage": [
      "serverAuth",
      "clientAuth"
    ]
  }
}

</pre>
</div>
<figcaption><a href="#figure-10" class="selfRef">Figure 10</a>:
<a href="#name-example-csr-template" class="selfRef">Example CSR Template</a>
          </figcaption></figure>
</div>
</section>
</div>
</section>
</div>
<div id="further-use-cases">
<section id="section-5">
      <h2 id="name-further-use-cases">
<a href="#section-5" class="section-number selfRef">5. </a><a href="#name-further-use-cases" class="section-name selfRef">Further Use Cases</a>
      </h2>
<p id="section-5-1">This nonnormative section describes additional use cases implementing the STAR certificate
delegation in nontrivial ways.<a href="#section-5-1" class="pilcrow">¶</a></p>
<div id="cdn-interconnection-cdni">
<section id="section-5.1">
        <h3 id="name-cdn-interconnection-cdni">
<a href="#section-5.1" class="section-number selfRef">5.1. </a><a href="#name-cdn-interconnection-cdni" class="section-name selfRef">CDN Interconnection (CDNI)</a>
        </h3>
<p id="section-5.1-1"><span>[<a href="#I-D.ietf-cdni-interfaces-https-delegation" class="xref">HTTPS-DELEGATION</a>]</span> discusses several solutions
addressing different delegation requirements for the CDN Interconnection (CDNI)
environment.  This section discusses two of the stated requirements in the
context of the STAR delegation workflow.<a href="#section-5.1-1" class="pilcrow">¶</a></p>
<p id="section-5.1-2">This section uses specific CDNI terminology, e.g., Upstream CDN (uCDN) and Downstream (dCDN), as defined in <span>[<a href="#RFC7336" class="xref">RFC7336</a>]</span>.<a href="#section-5.1-2" class="pilcrow">¶</a></p>
<div id="multiple-parallel-delegates">
<section id="section-5.1.1">
          <h4 id="name-multiple-parallel-delegates">
<a href="#section-5.1.1" class="section-number selfRef">5.1.1. </a><a href="#name-multiple-parallel-delegates" class="section-name selfRef">Multiple Parallel Delegates</a>
          </h4>
<p id="section-5.1.1-1">In some cases, the content owner (IdO) would like to delegate authority over a
website to multiple NDCs (CDNs).  This could happen if the IdO has agreements
in place with different regional CDNs for different geographical regions or if
a "backup" CDN is used to handle overflow traffic by temporarily altering some
of the CNAME mappings in place.  The STAR delegation flow enables this use case
naturally, since each CDN can authenticate separately to the IdO (via its own
separate account) specifying its CSR, and the IdO is free to allow or deny each
certificate request according to its own policy.<a href="#section-5.1.1-1" class="pilcrow">¶</a></p>
</section>
</div>
<div id="sec-cdni-dele">
<section id="section-5.1.2">
          <h4 id="name-chained-delegation">
<a href="#section-5.1.2" class="section-number selfRef">5.1.2. </a><a href="#name-chained-delegation" class="section-name selfRef">Chained Delegation</a>
          </h4>
<p id="section-5.1.2-1">In other cases, a content owner (IdO) delegates some domains to a large CDN
(uCDN), which in turn delegates to a smaller regional CDN (dCDN).  The IdO has a
contractual relationship with uCDN, and uCDN has a similar relationship with
dCDN.  However, IdO may not even know about dCDN.<a href="#section-5.1.2-1" class="pilcrow">¶</a></p>
<p id="section-5.1.2-2">If needed, the STAR protocol can be chained to support this use case: uCDN
could forward requests from dCDN to IdO and forward responses back to dCDN.
Whether such proxying is allowed is governed by policy and contracts between
the parties.<a href="#section-5.1.2-2" class="pilcrow">¶</a></p>
<p id="section-5.1.2-3">A mechanism is necessary at the interface between uCDN and dCDN, by which the
uCDN can advertise:<a href="#section-5.1.2-3" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-5.1.2-4.1">the names that the dCDN is allowed to use and<a href="#section-5.1.2-4.1" class="pilcrow">¶</a>
</li>
            <li class="normal" id="section-5.1.2-4.2">the policy for creating the key material (allowed algorithms, minimum key
lengths, key usage, etc.) that the dCDN needs to satisfy.<a href="#section-5.1.2-4.2" class="pilcrow">¶</a>
</li>
          </ul>
<p id="section-5.1.2-5">Note that such mechanism is provided by the CSR template.<a href="#section-5.1.2-5" class="pilcrow">¶</a></p>
<div id="two-level-delegation-in-cdni">
<section id="section-5.1.2.1">
            <h5 id="name-two-level-delegation-in-cdn">
<a href="#section-5.1.2.1" class="section-number selfRef">5.1.2.1. </a><a href="#name-two-level-delegation-in-cdn" class="section-name selfRef">Two-Level Delegation in CDNI</a>
            </h5>
<p id="section-5.1.2.1-1">A User Agent (UA), e.g., a browser or set-top box, wants to fetch the video resource at
the following URI: <code>https://video.cp.example/movie</code>.  
Redirection between the 
content provider (CP) and upstream and downstream CDNs is arranged as a
CNAME-based aliasing chain, as illustrated in <a href="#fig-cdni-dns-redirection" class="xref">Figure 11</a>.<a href="#section-5.1.2.1-1" class="pilcrow">¶</a></p>
<span id="name-dns-redirection"></span><div id="fig-cdni-dns-redirection">
<figure id="figure-11">
              <div id="section-5.1.2.1-2.1">
                <div class="artwork art-svg alignLeft" id="section-5.1.2.1-2.1.1">
<svg xmlns="http://www.w3.org/2000/svg" class="diagram" version="1.1" viewBox="0 0 780.0 489.0">
                    <g transform="translate(8,16)">
                      <path d="M 400,16 L 488,16" fill="none" stroke="black"></path>
                      <path d="M 400,32 L 448,32" fill="none" stroke="black"></path>
                      <path d="M 120,48 L 392,48" fill="none" stroke="black"></path>
                      <path d="M 152,80 L 400,80" fill="none" stroke="black"></path>
                      <path d="M 400,96 L 448,96" fill="none" stroke="black"></path>
                      <path d="M 400,112 L 488,112" fill="none" stroke="black"></path>
                      <path d="M 16,160 L 96,160" fill="none" stroke="black"></path>
                      <path d="M 112,160 L 128,160" fill="none" stroke="black"></path>
                      <path d="M 144,160 L 152,160" fill="none" stroke="black"></path>
                      <path d="M 400,160 L 488,160" fill="none" stroke="black"></path>
                      <path d="M 40,176 L 88,176" fill="none" stroke="black"></path>
                      <path d="M 88,176 L 104,176" fill="none" stroke="black"></path>
                      <path d="M 104,176 L 152,176" fill="none" stroke="black"></path>
                      <path d="M 400,176 L 448,176" fill="none" stroke="black"></path>
                      <path d="M 152,192 L 392,192" fill="none" stroke="black"></path>
                      <path d="M 160,224 L 400,224" fill="none" stroke="black"></path>
                      <path d="M 40,240 L 64,240" fill="none" stroke="black"></path>
                      <path d="M 64,240 L 88,240" fill="none" stroke="black"></path>
                      <path d="M 88,240 L 136,240" fill="none" stroke="black"></path>
                      <path d="M 136,240 L 152,240" fill="none" stroke="black"></path>
                      <path d="M 400,240 L 448,240" fill="none" stroke="black"></path>
                      <path d="M 16,256 L 56,256" fill="none" stroke="black"></path>
                      <path d="M 72,256 L 96,256" fill="none" stroke="black"></path>
                      <path d="M 112,256 L 128,256" fill="none" stroke="black"></path>
                      <path d="M 144,256 L 152,256" fill="none" stroke="black"></path>
                      <path d="M 400,256 L 488,256" fill="none" stroke="black"></path>
                      <path d="M 400,304 L 488,304" fill="none" stroke="black"></path>
                      <path d="M 400,320 L 448,320" fill="none" stroke="black"></path>
                      <path d="M 152,336 L 392,336" fill="none" stroke="black"></path>
                      <path d="M 120,368 L 400,368" fill="none" stroke="black"></path>
                      <path d="M 400,384 L 448,384" fill="none" stroke="black"></path>
                      <path d="M 80,416 L 392,416" fill="none" stroke="black"></path>
                      <path d="M 400,448 L 448,448" fill="none" stroke="black"></path>
                      <path d="M 400,464 L 488,464" fill="none" stroke="black"></path>
                      <path d="M 0,176 L 0,240" fill="none" stroke="black"></path>
                      <path d="M 40,176 L 40,240" fill="none" stroke="black"></path>
                      <path d="M 64,240 L 64,400" fill="none" stroke="black"></path>
                      <path d="M 88,176 L 88,240" fill="none" stroke="black"></path>
                      <path d="M 104,64 L 104,176" fill="none" stroke="black"></path>
                      <path d="M 104,256 L 104,352" fill="none" stroke="black"></path>
                      <path d="M 136,96 L 136,160" fill="none" stroke="black"></path>
                      <path d="M 136,240 L 136,320" fill="none" stroke="black"></path>
                      <path d="M 152,176 L 152,192" fill="none" stroke="black"></path>
                      <path d="M 152,192 L 152,240" fill="none" stroke="black"></path>
                      <path d="M 168,200 L 168,216" fill="none" stroke="black"></path>
                      <path d="M 384,56 L 384,72" fill="none" stroke="black"></path>
                      <path d="M 384,200 L 384,216" fill="none" stroke="black"></path>
                      <path d="M 384,344 L 384,360" fill="none" stroke="black"></path>
                      <path d="M 384,384 L 384,400" fill="none" stroke="black"></path>
                      <path d="M 384,432 L 384,448" fill="none" stroke="black"></path>
                      <path d="M 400,32 L 400,80" fill="none" stroke="black"></path>
                      <path d="M 400,80 L 400,96" fill="none" stroke="black"></path>
                      <path d="M 400,176 L 400,224" fill="none" stroke="black"></path>
                      <path d="M 400,224 L 400,240" fill="none" stroke="black"></path>
                      <path d="M 400,320 L 400,368" fill="none" stroke="black"></path>
                      <path d="M 400,368 L 400,384" fill="none" stroke="black"></path>
                      <path d="M 400,384 L 400,448" fill="none" stroke="black"></path>
                      <path d="M 448,32 L 448,96" fill="none" stroke="black"></path>
                      <path d="M 448,176 L 448,240" fill="none" stroke="black"></path>
                      <path d="M 448,320 L 448,384" fill="none" stroke="black"></path>
                      <path d="M 448,384 L 448,448" fill="none" stroke="black"></path>
                      <path d="M 504,32 L 504,96" fill="none" stroke="black"></path>
                      <path d="M 504,176 L 504,240" fill="none" stroke="black"></path>
                      <path d="M 504,320 L 504,448" fill="none" stroke="black"></path>
                      <path d="M 168,176 L 168,184" fill="none" stroke="black"></path>
                      <path d="M 168,200 L 168,208" fill="none" stroke="black"></path>
                      <path d="M 168,232 L 168,240" fill="none" stroke="black"></path>
                      <path d="M 384,32 L 384,40" fill="none" stroke="black"></path>
                      <path d="M 384,56 L 384,64" fill="none" stroke="black"></path>
                      <path d="M 384,88 L 384,96" fill="none" stroke="black"></path>
                      <path d="M 384,176 L 384,184" fill="none" stroke="black"></path>
                      <path d="M 384,200 L 384,208" fill="none" stroke="black"></path>
                      <path d="M 384,232 L 384,240" fill="none" stroke="black"></path>
                      <path d="M 384,320 L 384,328" fill="none" stroke="black"></path>
                      <path d="M 384,344 L 384,352" fill="none" stroke="black"></path>
                      <path d="M 384,376 L 384,384" fill="none" stroke="black"></path>
                      <path d="M 384,400 L 384,408" fill="none" stroke="black"></path>
                      <path d="M 384,424 L 384,432" fill="none" stroke="black"></path>
                      <path d="M 104,248 L 104,256" fill="none" stroke="black"></path>
                      <polygon points="120.000000,256.000000 108.000000,250.399994 108.000000,261.600006" transform="rotate(270.000000, 104.000000, 256.000000)" fill="black"></polygon>
                      <path d="M 136,160 L 136,168" fill="none" stroke="black"></path>
                      <polygon points="152.000000,160.000000 140.000000,154.399994 140.000000,165.600006" transform="rotate(90.000000, 136.000000, 160.000000)" fill="black"></polygon>
                      <polygon points="168.000000,224.000000 156.000000,218.399994 156.000000,229.600006" transform="rotate(180.000000, 160.000000, 224.000000)" fill="black"></polygon>
                      <polygon points="400.000000,48.000000 388.000000,42.400002 388.000000,53.599998" transform="rotate(0.000000, 392.000000, 48.000000)" fill="black"></polygon>
                      <polygon points="400.000000,192.000000 388.000000,186.399994 388.000000,197.600006" transform="rotate(0.000000, 392.000000, 192.000000)" fill="black"></polygon>
                      <polygon points="400.000000,336.000000 388.000000,330.399994 388.000000,341.600006" transform="rotate(0.000000, 392.000000, 336.000000)" fill="black"></polygon>
                      <polygon points="400.000000,416.000000 388.000000,410.399994 388.000000,421.600006" transform="rotate(0.000000, 392.000000, 416.000000)" fill="black"></polygon>
                      <path d="M 400,16 A 16,16 0 0,0 384,32" fill="none" stroke="black"></path>
                      <path d="M 488,16 A 16,16 0 0,1 504,32" fill="none" stroke="black"></path>
                      <path d="M 120,48 A 16,16 0 0,0 104,64" fill="none" stroke="black"></path>
                      <path d="M 152,80 A 16,16 0 0,0 136,96" fill="none" stroke="black"></path>
                      <path d="M 384,96 A 16,16 0 0,0 400,112" fill="none" stroke="black"></path>
                      <path d="M 504,96 A 16,16 0 0,1 488,112" fill="none" stroke="black"></path>
                      <path d="M 16,160 A 16,16 0 0,0 0,176" fill="none" stroke="black"></path>
                      <path d="M 152,160 A 16,16 0 0,1 168,176" fill="none" stroke="black"></path>
                      <path d="M 400,160 A 16,16 0 0,0 384,176" fill="none" stroke="black"></path>
                      <path d="M 488,160 A 16,16 0 0,1 504,176" fill="none" stroke="black"></path>
                      <path d="M 0,240 A 16,16 0 0,0 16,256" fill="none" stroke="black"></path>
                      <path d="M 168,240 A 16,16 0 0,1 152,256" fill="none" stroke="black"></path>
                      <path d="M 384,240 A 16,16 0 0,0 400,256" fill="none" stroke="black"></path>
                      <path d="M 504,240 A 16,16 0 0,1 488,256" fill="none" stroke="black"></path>
                      <path d="M 400,304 A 16,16 0 0,0 384,320" fill="none" stroke="black"></path>
                      <path d="M 488,304 A 16,16 0 0,1 504,320" fill="none" stroke="black"></path>
                      <path d="M 136,320 A 16,16 0 0,0 152,336" fill="none" stroke="black"></path>
                      <path d="M 104,352 A 16,16 0 0,0 120,368" fill="none" stroke="black"></path>
                      <path d="M 64,400 A 16,16 0 0,0 80,416" fill="none" stroke="black"></path>
                      <path d="M 384,448 A 16,16 0 0,0 400,464" fill="none" stroke="black"></path>
                      <path d="M 504,448 A 16,16 0 0,1 488,464" fill="none" stroke="black"></path>
                      <text text-anchor="middle" font-family="monospace" x="264" y="36" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="100" fill="black" font-size="1em">M</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="180" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="180" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="244" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="436" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="244" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="36" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="36" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="68" fill="black" font-size="1em">(</text>
                      <text text-anchor="middle" font-family="monospace" x="424" y="68" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="352" y="100" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="16" y="212" fill="black" font-size="1em">U</text>
                      <text text-anchor="middle" font-family="monospace" x="424" y="212" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="324" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="36" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="100" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="72" y="212" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="436" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="336" y="100" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="24" y="212" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="244" fill="black" font-size="1em">n</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="356" fill="black" font-size="1em">(</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="36" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="352" y="180" fill="black" font-size="1em">?</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="244" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="488" y="388" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="328" y="436" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="180" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="464" y="212" fill="black" font-size="1em">u</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="324" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="436" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="416" y="68" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="328" y="180" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="324" fill="black" font-size="1em">n</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="388" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="436" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="436" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="36" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="100" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="100" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="100" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="180" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="244" fill="black" font-size="1em">M</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="100" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="180" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="324" fill="black" font-size="1em">x</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="436" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="68" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="100" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="200" y="180" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="388" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="472" y="212" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="244" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="244" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="388" fill="black" font-size="1em">0</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="436" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="200" y="36" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="180" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="324" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="436" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="212" fill="black" font-size="1em">(</text>
                      <text text-anchor="middle" font-family="monospace" x="480" y="388" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="420" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="436" fill="black" font-size="1em">:</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="36" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="112" y="212" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="356" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="416" y="420" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="180" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="180" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="180" fill="black" font-size="1em">n</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="244" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="200" y="324" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="324" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="388" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="416" y="356" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="36" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="100" fill="black" font-size="1em">x</text>
                      <text text-anchor="middle" font-family="monospace" x="328" y="100" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="336" y="180" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="120" y="212" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="244" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="344" y="244" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="436" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="36" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="436" fill="black" font-size="1em">x</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="356" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="388" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="436" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="100" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="324" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="388" fill="black" font-size="1em">2</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="36" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="480" y="68" fill="black" font-size="1em">P</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="100" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="480" y="212" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="488" y="212" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="200" y="244" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="424" y="356" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="424" y="420" fill="black" font-size="1em">L</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="100" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="244" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="244" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="324" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="324" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="356" fill="black" font-size="1em">)</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="36" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="100" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="56" y="212" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="320" y="244" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="368" y="244" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="436" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="68" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="212" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="352" y="244" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="324" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="388" fill="black" font-size="1em">2</text>
                      <text text-anchor="middle" font-family="monospace" x="312" y="436" fill="black" font-size="1em">p</text>
                      <text text-anchor="middle" font-family="monospace" x="328" y="324" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="100" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="100" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="100" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="180" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="336" y="244" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="324" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="324" fill="black" font-size="1em">a</text>
                      <text text-anchor="middle" font-family="monospace" x="464" y="388" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="200" y="100" fill="black" font-size="1em">E</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="100" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="128" y="212" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="324" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="388" fill="black" font-size="1em">9</text>
                      <text text-anchor="middle" font-family="monospace" x="472" y="388" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="436" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="336" y="36" fill="black" font-size="1em">?</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="180" fill="black" font-size="1em">u</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="212" fill="black" font-size="1em">b</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="244" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="324" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="436" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="436" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="36" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="344" y="100" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="180" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="416" y="212" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="436" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="36" fill="black" font-size="1em">m</text>
                      <text text-anchor="middle" font-family="monospace" x="264" y="100" fill="black" font-size="1em">u</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="388" fill="black" font-size="1em">1</text>
                      <text text-anchor="middle" font-family="monospace" x="280" y="36" fill="black" font-size="1em">x</text>
                      <text text-anchor="middle" font-family="monospace" x="288" y="100" fill="black" font-size="1em">n</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="180" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="212" fill="black" font-size="1em">)</text>
                      <text text-anchor="middle" font-family="monospace" x="344" y="324" fill="black" font-size="1em">?</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="388" fill="black" font-size="1em">1</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="436" fill="black" font-size="1em">I</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="36" fill="black" font-size="1em">o</text>
                      <text text-anchor="middle" font-family="monospace" x="360" y="244" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="324" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="256" y="324" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="68" fill="black" font-size="1em">)</text>
                      <text text-anchor="middle" font-family="monospace" x="472" y="68" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="64" y="212" fill="black" font-size="1em">L</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="244" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="244" fill="black" font-size="1em">E</text>
                      <text text-anchor="middle" font-family="monospace" x="272" y="244" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="328" y="244" fill="black" font-size="1em">x</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="180" fill="black" font-size="1em">.</text>
                      <text text-anchor="middle" font-family="monospace" x="296" y="180" fill="black" font-size="1em">x</text>
                    </g>
                  </svg><a href="#section-5.1.2.1-2.1.1" class="pilcrow">¶</a>
</div>
</div>
<figcaption><a href="#figure-11" class="selfRef">Figure 11</a>:
<a href="#name-dns-redirection" class="selfRef">DNS Redirection</a>
              </figcaption></figure>
</div>
<p id="section-5.1.2.1-3">Unlike HTTP-based redirection, where the original URL is supplanted by the one
found in the <code>Location</code> header of the 302 response, DNS redirection is completely
transparent to the User Agent.  As a result, the TLS connection to the dCDN
edge is done with a Server Name Indication (SNI) equal to the <code>host</code> in the
original URI -- in the example, <code>video.cp.example</code>.  So, in order to
successfully complete the handshake, the landing dCDN node has to be configured
with a certificate whose <code>subjectAltName</code> field matches <code>video.cp.example</code>, i.e., a
content provider's name.<a href="#section-5.1.2.1-3" class="pilcrow">¶</a></p>
<p id="section-5.1.2.1-4"><a href="#fig-cdni-flow" class="xref">Figure 12</a> illustrates the cascaded delegation flow that allows dCDN to
obtain a STAR certificate that bears a name belonging to the content provider
with a private key that is only known to the dCDN.<a href="#section-5.1.2.1-4" class="pilcrow">¶</a></p>
<span id="name-two-level-delegation-in-cdni"></span><div id="fig-cdni-flow">
<figure id="figure-12">
              <div id="section-5.1.2.1-5.1">
                <div class="artwork art-svg alignLeft" id="section-5.1.2.1-5.1.1">
<svg xmlns="http://www.w3.org/2000/svg" class="diagram" version="1.1" viewBox="0 0 696.0 553.0">
                    <g transform="translate(8,16)">
                      <path d="M 96,16 L 248,16" fill="none" stroke="black"></path>
                      <path d="M 136,32 L 192,32" fill="none" stroke="black"></path>
                      <path d="M 192,32 L 248,32" fill="none" stroke="black"></path>
                      <path d="M 256,48 L 360,48" fill="none" stroke="black"></path>
                      <path d="M 248,80 L 288,80" fill="none" stroke="black"></path>
                      <path d="M 136,96 L 168,96" fill="none" stroke="black"></path>
                      <path d="M 168,96 L 192,96" fill="none" stroke="black"></path>
                      <path d="M 192,96 L 248,96" fill="none" stroke="black"></path>
                      <path d="M 96,112 L 160,112" fill="none" stroke="black"></path>
                      <path d="M 176,112 L 216,112" fill="none" stroke="black"></path>
                      <path d="M 232,112 L 248,112" fill="none" stroke="black"></path>
                      <path d="M 360,128 L 368,128" fill="none" stroke="black"></path>
                      <path d="M 384,128 L 432,128" fill="none" stroke="black"></path>
                      <path d="M 360,144 L 376,144" fill="none" stroke="black"></path>
                      <path d="M 376,144 L 416,144" fill="none" stroke="black"></path>
                      <path d="M 320,160 L 352,160" fill="none" stroke="black"></path>
                      <path d="M 360,192 L 408,192" fill="none" stroke="black"></path>
                      <path d="M 360,224 L 400,224" fill="none" stroke="black"></path>
                      <path d="M 400,224 L 416,224" fill="none" stroke="black"></path>
                      <path d="M 360,240 L 368,240" fill="none" stroke="black"></path>
                      <path d="M 384,240 L 392,240" fill="none" stroke="black"></path>
                      <path d="M 408,240 L 432,240" fill="none" stroke="black"></path>
                      <path d="M 56,256 L 160,256" fill="none" stroke="black"></path>
                      <path d="M 176,256 L 184,256" fill="none" stroke="black"></path>
                      <path d="M 200,256 L 208,256" fill="none" stroke="black"></path>
                      <path d="M 96,272 L 152,272" fill="none" stroke="black"></path>
                      <path d="M 152,272 L 192,272" fill="none" stroke="black"></path>
                      <path d="M 192,272 L 208,272" fill="none" stroke="black"></path>
                      <path d="M 96,336 L 136,336" fill="none" stroke="black"></path>
                      <path d="M 136,336 L 152,336" fill="none" stroke="black"></path>
                      <path d="M 152,336 L 168,336" fill="none" stroke="black"></path>
                      <path d="M 168,336 L 208,336" fill="none" stroke="black"></path>
                      <path d="M 56,352 L 104,352" fill="none" stroke="black"></path>
                      <path d="M 120,352 L 128,352" fill="none" stroke="black"></path>
                      <path d="M 144,352 L 160,352" fill="none" stroke="black"></path>
                      <path d="M 176,352 L 184,352" fill="none" stroke="black"></path>
                      <path d="M 200,352 L 208,352" fill="none" stroke="black"></path>
                      <path d="M 56,432 L 104,432" fill="none" stroke="black"></path>
                      <path d="M 120,432 L 128,432" fill="none" stroke="black"></path>
                      <path d="M 144,432 L 160,432" fill="none" stroke="black"></path>
                      <path d="M 176,432 L 184,432" fill="none" stroke="black"></path>
                      <path d="M 200,432 L 264,432" fill="none" stroke="black"></path>
                      <path d="M 96,448 L 112,448" fill="none" stroke="black"></path>
                      <path d="M 112,448 L 152,448" fill="none" stroke="black"></path>
                      <path d="M 152,448 L 192,448" fill="none" stroke="black"></path>
                      <path d="M 192,448 L 208,448" fill="none" stroke="black"></path>
                      <path d="M 208,448 L 264,448" fill="none" stroke="black"></path>
                      <path d="M 264,464 L 360,464" fill="none" stroke="black"></path>
                      <path d="M 272,496 L 384,496" fill="none" stroke="black"></path>
                      <path d="M 96,512 L 152,512" fill="none" stroke="black"></path>
                      <path d="M 152,512 L 208,512" fill="none" stroke="black"></path>
                      <path d="M 208,512 L 264,512" fill="none" stroke="black"></path>
                      <path d="M 56,528 L 264,528" fill="none" stroke="black"></path>
                      <path d="M 40,272 L 40,336" fill="none" stroke="black"></path>
                      <path d="M 40,448 L 40,512" fill="none" stroke="black"></path>
                      <path d="M 80,32 L 80,96" fill="none" stroke="black"></path>
                      <path d="M 96,272 L 96,336" fill="none" stroke="black"></path>
                      <path d="M 96,448 L 96,512" fill="none" stroke="black"></path>
                      <path d="M 112,352 L 112,384" fill="none" stroke="black"></path>
                      <path d="M 112,416 L 112,448" fill="none" stroke="black"></path>
                      <path d="M 136,32 L 136,96" fill="none" stroke="black"></path>
                      <path d="M 136,336 L 136,368" fill="none" stroke="black"></path>
                      <path d="M 136,400 L 136,432" fill="none" stroke="black"></path>
                      <path d="M 152,272 L 152,336" fill="none" stroke="black"></path>
                      <path d="M 152,448 L 152,512" fill="none" stroke="black"></path>
                      <path d="M 168,96 L 168,144" fill="none" stroke="black"></path>
                      <path d="M 168,176 L 168,256" fill="none" stroke="black"></path>
                      <path d="M 168,336 L 168,368" fill="none" stroke="black"></path>
                      <path d="M 168,400 L 168,432" fill="none" stroke="black"></path>
                      <path d="M 192,32 L 192,96" fill="none" stroke="black"></path>
                      <path d="M 192,256 L 192,272" fill="none" stroke="black"></path>
                      <path d="M 192,352 L 192,384" fill="none" stroke="black"></path>
                      <path d="M 192,416 L 192,448" fill="none" stroke="black"></path>
                      <path d="M 208,272 L 208,336" fill="none" stroke="black"></path>
                      <path d="M 208,448 L 208,512" fill="none" stroke="black"></path>
                      <path d="M 224,112 L 224,176" fill="none" stroke="black"></path>
                      <path d="M 224,208 L 224,224" fill="none" stroke="black"></path>
                      <path d="M 224,272 L 224,336" fill="none" stroke="black"></path>
                      <path d="M 248,32 L 248,80" fill="none" stroke="black"></path>
                      <path d="M 248,80 L 248,96" fill="none" stroke="black"></path>
                      <path d="M 264,56 L 264,72" fill="none" stroke="black"></path>
                      <path d="M 264,448 L 264,464" fill="none" stroke="black"></path>
                      <path d="M 264,464 L 264,512" fill="none" stroke="black"></path>
                      <path d="M 280,472 L 280,488" fill="none" stroke="black"></path>
                      <path d="M 304,128 L 304,144" fill="none" stroke="black"></path>
                      <path d="M 344,176 L 344,224" fill="none" stroke="black"></path>
                      <path d="M 360,144 L 360,192" fill="none" stroke="black"></path>
                      <path d="M 360,192 L 360,224" fill="none" stroke="black"></path>
                      <path d="M 376,64 L 376,80" fill="none" stroke="black"></path>
                      <path d="M 376,112 L 376,144" fill="none" stroke="black"></path>
                      <path d="M 376,240 L 376,400" fill="none" stroke="black"></path>
                      <path d="M 376,432 L 376,448" fill="none" stroke="black"></path>
                      <path d="M 400,224 L 400,256" fill="none" stroke="black"></path>
                      <path d="M 400,288 L 400,480" fill="none" stroke="black"></path>
                      <path d="M 416,144 L 416,224" fill="none" stroke="black"></path>
                      <path d="M 448,144 L 448,224" fill="none" stroke="black"></path>
                      <path d="M 264,32 L 264,40" fill="none" stroke="black"></path>
                      <path d="M 264,56 L 264,64" fill="none" stroke="black"></path>
                      <path d="M 264,88 L 264,96" fill="none" stroke="black"></path>
                      <path d="M 280,448 L 280,456" fill="none" stroke="black"></path>
                      <path d="M 280,472 L 280,480" fill="none" stroke="black"></path>
                      <path d="M 280,504 L 280,512" fill="none" stroke="black"></path>
                      <path d="M 344,144 L 344,152" fill="none" stroke="black"></path>
                      <path d="M 344,168 L 344,176" fill="none" stroke="black"></path>
                      <path d="M 112,344 L 112,352" fill="none" stroke="black"></path>
                      <polygon points="128.000000,352.000000 116.000000,346.399994 116.000000,357.600006" transform="rotate(270.000000, 112.000000, 352.000000)" fill="black"></polygon>
                      <path d="M 136,432 L 136,440" fill="none" stroke="black"></path>
                      <polygon points="152.000000,432.000000 140.000000,426.399994 140.000000,437.600006" transform="rotate(90.000000, 136.000000, 432.000000)" fill="black"></polygon>
                      <path d="M 168,256 L 168,264" fill="none" stroke="black"></path>
                      <polygon points="184.000000,256.000000 172.000000,250.399994 172.000000,261.600006" transform="rotate(90.000000, 168.000000, 256.000000)" fill="black"></polygon>
                      <path d="M 168,432 L 168,440" fill="none" stroke="black"></path>
                      <polygon points="184.000000,432.000000 172.000000,426.399994 172.000000,437.600006" transform="rotate(90.000000, 168.000000, 432.000000)" fill="black"></polygon>
                      <path d="M 192,344 L 192,352" fill="none" stroke="black"></path>
                      <polygon points="208.000000,352.000000 196.000000,346.399994 196.000000,357.600006" transform="rotate(270.000000, 192.000000, 352.000000)" fill="black"></polygon>
                      <path d="M 224,104 L 224,112" fill="none" stroke="black"></path>
                      <polygon points="240.000000,112.000000 228.000000,106.400002 228.000000,117.599998" transform="rotate(270.000000, 224.000000, 112.000000)" fill="black"></polygon>
                      <polygon points="264.000000,48.000000 252.000000,42.400002 252.000000,53.599998" transform="rotate(180.000000, 256.000000, 48.000000)" fill="black"></polygon>
                      <polygon points="280.000000,496.000000 268.000000,490.399994 268.000000,501.600006" transform="rotate(180.000000, 272.000000, 496.000000)" fill="black"></polygon>
                      <polygon points="360.000000,160.000000 348.000000,154.399994 348.000000,165.600006" transform="rotate(0.000000, 352.000000, 160.000000)" fill="black"></polygon>
                      <path d="M 376,232 L 376,240" fill="none" stroke="black"></path>
                      <polygon points="392.000000,240.000000 380.000000,234.399994 380.000000,245.600006" transform="rotate(270.000000, 376.000000, 240.000000)" fill="black"></polygon>
                      <path d="M 96,16 A 16,16 0 0,0 80,32" fill="none" stroke="black"></path>
                      <path d="M 248,16 A 16,16 0 0,1 264,32" fill="none" stroke="black"></path>
                      <path d="M 360,48 A 16,16 0 0,1 376,64" fill="none" stroke="black"></path>
                      <path d="M 288,80 A 16,16 0 0,1 304,96" fill="none" stroke="black"></path>
                      <path d="M 80,96 A 16,16 0 0,0 96,112" fill="none" stroke="black"></path>
                      <path d="M 264,96 A 16,16 0 0,1 248,112" fill="none" stroke="black"></path>
                      <path d="M 360,128 A 16,16 0 0,0 344,144" fill="none" stroke="black"></path>
                      <path d="M 432,128 A 16,16 0 0,1 448,144" fill="none" stroke="black"></path>
                      <path d="M 304,144 A 16,16 0 0,0 320,160" fill="none" stroke="black"></path>
                      <path d="M 208,240 A 16,16 0 0,0 192,256" fill="none" stroke="black"></path>
                      <path d="M 224,224 A 16,16 0 0,1 208,240" fill="none" stroke="black"></path>
                      <path d="M 344,224 A 16,16 0 0,0 360,240" fill="none" stroke="black"></path>
                      <path d="M 448,224 A 16,16 0 0,1 432,240" fill="none" stroke="black"></path>
                      <path d="M 56,256 A 16,16 0 0,0 40,272" fill="none" stroke="black"></path>
                      <path d="M 208,256 A 16,16 0 0,1 224,272" fill="none" stroke="black"></path>
                      <path d="M 40,336 A 16,16 0 0,0 56,352" fill="none" stroke="black"></path>
                      <path d="M 224,336 A 16,16 0 0,1 208,352" fill="none" stroke="black"></path>
                      <path d="M 56,432 A 16,16 0 0,0 40,448" fill="none" stroke="black"></path>
                      <path d="M 264,432 A 16,16 0 0,1 280,448" fill="none" stroke="black"></path>
                      <path d="M 376,448 A 16,16 0 0,1 360,464" fill="none" stroke="black"></path>
                      <path d="M 400,480 A 16,16 0 0,1 384,496" fill="none" stroke="black"></path>
                      <path d="M 40,512 A 16,16 0 0,0 56,528" fill="none" stroke="black"></path>
                      <path d="M 280,512 A 16,16 0 0,1 264,528" fill="none" stroke="black"></path>
                      <text text-anchor="middle" font-family="monospace" x="168" y="84" fill="black" font-size="1em">v</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="84" fill="black" font-size="1em">i</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="308" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="468" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="64" y="484" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="400" y="276" fill="black" font-size="1em">1</text>
                      <text text-anchor="middle" font-family="monospace" x="112" y="308" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="308" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="308" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="468" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="468" fill="black" font-size="1em">R</text>
                      <text text-anchor="middle" font-family="monospace" x="72" y="484" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="500" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="376" y="180" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="56" y="308" fill="black" font-size="1em">u</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="324" fill="black" font-size="1em">w</text>
                      <text text-anchor="middle" font-family="monospace" x="160" y="52" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="392" y="164" fill="black" font-size="1em">M</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="388" fill="black" font-size="1em">8</text>
                      <text text-anchor="middle" font-family="monospace" x="128" y="484" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="484" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="52" fill="black" font-size="1em">E</text>
                      <text text-anchor="middle" font-family="monospace" x="112" y="68" fill="black" font-size="1em">P</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="84" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="384" y="180" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="292" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="160" y="84" fill="black" font-size="1em">r</text>
                      <text text-anchor="middle" font-family="monospace" x="400" y="164" fill="black" font-size="1em">E</text>
                      <text text-anchor="middle" font-family="monospace" x="408" y="276" fill="black" font-size="1em">0</text>
                      <text text-anchor="middle" font-family="monospace" x="112" y="484" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="136" y="484" fill="black" font-size="1em">I</text>
                      <text text-anchor="middle" font-family="monospace" x="120" y="308" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="104" y="68" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="68" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="84" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="400" y="180" fill="black" font-size="1em">R</text>
                      <text text-anchor="middle" font-family="monospace" x="376" y="212" fill="black" font-size="1em">H</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="180" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="292" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="292" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="136" y="308" fill="black" font-size="1em">I</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="324" fill="black" font-size="1em">f</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="484" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="52" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="52" fill="black" font-size="1em">M</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="68" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="216" y="68" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="384" y="212" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="136" y="388" fill="black" font-size="1em">2</text>
                      <text text-anchor="middle" font-family="monospace" x="112" y="404" fill="black" font-size="1em">1</text>
                      <text text-anchor="middle" font-family="monospace" x="56" y="484" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="52" fill="black" font-size="1em">R</text>
                      <text text-anchor="middle" font-family="monospace" x="152" y="68" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="376" y="164" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="292" fill="black" font-size="1em">R</text>
                      <text text-anchor="middle" font-family="monospace" x="128" y="308" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="484" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="248" y="484" fill="black" font-size="1em">P</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="484" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="240" y="484" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="52" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="52" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="232" y="68" fill="black" font-size="1em">R</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="164" fill="black" font-size="1em">7</text>
                      <text text-anchor="middle" font-family="monospace" x="192" y="404" fill="black" font-size="1em">3</text>
                      <text text-anchor="middle" font-family="monospace" x="384" y="164" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="432" y="196" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="72" y="308" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="324" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="176" y="468" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="400" y="212" fill="black" font-size="1em">P</text>
                      <text text-anchor="middle" font-family="monospace" x="80" y="308" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="308" fill="black" font-size="1em">l</text>
                      <text text-anchor="middle" font-family="monospace" x="152" y="52" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="152" y="84" fill="black" font-size="1em">s</text>
                      <text text-anchor="middle" font-family="monospace" x="304" y="116" fill="black" font-size="1em">5</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="196" fill="black" font-size="1em">4</text>
                      <text text-anchor="middle" font-family="monospace" x="392" y="212" fill="black" font-size="1em">T</text>
                      <text text-anchor="middle" font-family="monospace" x="208" y="68" fill="black" font-size="1em">S</text>
                      <text text-anchor="middle" font-family="monospace" x="64" y="308" fill="black" font-size="1em">C</text>
                      <text text-anchor="middle" font-family="monospace" x="120" y="484" fill="black" font-size="1em">D</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="500" fill="black" font-size="1em">c</text>
                      <text text-anchor="middle" font-family="monospace" x="80" y="484" fill="black" font-size="1em">N</text>
                      <text text-anchor="middle" font-family="monospace" x="168" y="484" fill="black" font-size="1em">d</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="484" fill="black" font-size="1em">H</text>
                      <text text-anchor="middle" font-family="monospace" x="160" y="68" fill="black" font-size="1em">e</text>
                      <text text-anchor="middle" font-family="monospace" x="224" y="68" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="376" y="100" fill="black" font-size="1em">6</text>
                      <text text-anchor="middle" font-family="monospace" x="392" y="180" fill="black" font-size="1em">A</text>
                      <text text-anchor="middle" font-family="monospace" x="376" y="420" fill="black" font-size="1em">9</text>
                      <text text-anchor="middle" font-family="monospace" x="184" y="500" fill="black" font-size="1em">i</text>
                    </g>
                  </svg><a href="#section-5.1.2.1-5.1.1" class="pilcrow">¶</a>
</div>
</div>
<figcaption><a href="#figure-12" class="selfRef">Figure 12</a>:
<a href="#name-two-level-delegation-in-cdni" class="selfRef">Two-Level Delegation in CDNI</a>
              </figcaption></figure>
</div>
<p id="section-5.1.2.1-6">uCDN is configured to delegate to dCDN, and CP is configured to delegate to uCDN, both as defined in <a href="#sec-profile-dele-config" class="xref">Section 2.3.1</a>.<a href="#section-5.1.2.1-6" class="pilcrow">¶</a></p>
<ol start="1" type="1" class="normal type-1" id="section-5.1.2.1-7">
       <li id="section-5.1.2.1-7.1">dCDN requests CDNI path metadata to uCDN.<a href="#section-5.1.2.1-7.1" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.2">uCDN replies with, among other CDNI metadata, the STAR delegation
configuration, which includes the delegated content provider's name.<a href="#section-5.1.2.1-7.2" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.3">dCDN creates a key pair and the CSR with the delegated name.  It then places
an order for the delegated name to uCDN.<a href="#section-5.1.2.1-7.3" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.4">uCDN forwards the received order to the content provider (CP).<a href="#section-5.1.2.1-7.4" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.5">CP creates an order for a STAR certificate and sends it to the CA.  The
order also requests unauthenticated access to the certificate resource.<a href="#section-5.1.2.1-7.5" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.6">After all authorizations complete successfully, the STAR certificate is
issued.<a href="#section-5.1.2.1-7.6" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.7">CP notifies uCDN that the STAR certificate is available at the order's
<code>star-certificate</code> URL.<a href="#section-5.1.2.1-7.7" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.8">uCDN forwards the information to dCDN.  At this point, the ACME signaling is
complete.<a href="#section-5.1.2.1-7.8" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.9">dCDN requests the STAR certificate using unauthenticated GET from the CA.<a href="#section-5.1.2.1-7.9" class="pilcrow">¶</a>
</li>
              <li id="section-5.1.2.1-7.10">The CA returns the certificate.  Now dCDN is fully configured to handle
HTTPS traffic in lieu of the content provider.<a href="#section-5.1.2.1-7.10" class="pilcrow">¶</a>
</li>
            </ol>
<p id="section-5.1.2.1-8">Note that 9 and 10 repeat until the delegation expires or is terminated.<a href="#section-5.1.2.1-8" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
</section>
</div>
<div id="secure-telephone-identity-revisited-stir">
<section id="section-5.2">
        <h3 id="name-secure-telephone-identity-r">
<a href="#section-5.2" class="section-number selfRef">5.2. </a><a href="#name-secure-telephone-identity-r" class="section-name selfRef">Secure Telephone Identity Revisited (STIR)</a>
        </h3>
<p id="section-5.2-1">As a second use case, we consider the delegation of credentials in the STIR
ecosystem  <span>[<a href="#RFC9060" class="xref">RFC9060</a>]</span>.<a href="#section-5.2-1" class="pilcrow">¶</a></p>
<p id="section-5.2-2">This section uses STIR terminology. The term Personal Assertion Token (PASSporT) is defined in <span>[<a href="#RFC8225" class="xref">RFC8225</a>]</span>, and "TNAuthList" is defined in <span>[<a href="#RFC8226" class="xref">RFC8226</a>]</span>.<a href="#section-5.2-2" class="pilcrow">¶</a></p>
<p id="section-5.2-3">In the STIR delegated mode, a service provider SP2 -- the NDC -- needs to sign
PASSporTs <span>[<a href="#RFC8225" class="xref">RFC8225</a>]</span> for telephone numbers (e.g., TN=+123) belonging to
another service provider, SP1 -- the IdO.  In order to do that, SP2 needs a STIR
certificate and a private key that includes TN=+123 in the TNAuthList
<span>[<a href="#RFC8226" class="xref">RFC8226</a>]</span> certificate extension.<a href="#section-5.2-3" class="pilcrow">¶</a></p>
<p id="section-5.2-4">In detail (<a href="#fig-stir-flow" class="xref">Figure 13</a>):<a href="#section-5.2-4" class="pilcrow">¶</a></p>
<ol start="1" type="1" class="normal type-1" id="section-5.2-5">
   <li id="section-5.2-5.1">SP1 and SP2 agree on the configuration of the delegation -- in particular,
the CSR template that applies.<a href="#section-5.2-5.1" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.2">SP2 generates a private/public key pair and sends a CSR to SP1, requesting
creation of a certificate with an SP1 name, an SP2 public key, and a TNAuthList
extension with the list of TNs that SP1 delegates to SP2.  (Note that the
CSR sent by SP2 to SP1 needs to be validated against the CSR template
agreed upon in step 1.).<a href="#section-5.2-5.2" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.3">SP1 sends an order for the CSR to the CA.  The order also requests
unauthenticated access to the certificate resource.<a href="#section-5.2-5.3" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.4">Subsequently, after the required TNAuthList authorizations are successfully
completed, the CA moves the order to a "valid" state; at the same
time, the star-certificate endpoint is populated.<a href="#section-5.2-5.4" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.5">The contents of the order are forwarded from SP1 to SP2 by means of the paired
"delegation" order.<a href="#section-5.2-5.5" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.6">SP2 dereferences the <code>star-certificate</code> URL in the order to fetch the rolling
STAR certificate bearing the delegated identifiers.<a href="#section-5.2-5.6" class="pilcrow">¶</a>
</li>
          <li id="section-5.2-5.7">The STAR certificate is returned to SP2.<a href="#section-5.2-5.7" class="pilcrow">¶</a>
</li>
        </ol>
<span id="name-delegation-in-stir"></span><div id="fig-stir-flow">
<figure id="figure-13">
          <div id="section-5.2-6.1">
            <div class="artwork art-svg alignLeft" id="section-5.2-6.1.1">
<svg xmlns="http://www.w3.org/2000/svg" class="diagram" version="1.1" viewBox="0 0 612.0 377.0">
                <g transform="translate(8,16)">
                  <path d="M 56,16 L 200,16" fill="none" stroke="black"></path>
                  <path d="M 88,32 L 144,32" fill="none" stroke="black"></path>
                  <path d="M 144,32 L 200,32" fill="none" stroke="black"></path>
                  <path d="M 208,48 L 320,48" fill="none" stroke="black"></path>
                  <path d="M 16,64 L 32,64" fill="none" stroke="black"></path>
                  <path d="M 200,80 L 240,80" fill="none" stroke="black"></path>
                  <path d="M 88,96 L 128,96" fill="none" stroke="black"></path>
                  <path d="M 128,96 L 144,96" fill="none" stroke="black"></path>
                  <path d="M 144,96 L 200,96" fill="none" stroke="black"></path>
                  <path d="M 56,112 L 96,112" fill="none" stroke="black"></path>
                  <path d="M 112,112 L 120,112" fill="none" stroke="black"></path>
                  <path d="M 136,112 L 200,112" fill="none" stroke="black"></path>
                  <path d="M 304,128 L 328,128" fill="none" stroke="black"></path>
                  <path d="M 344,128 L 376,128" fill="none" stroke="black"></path>
                  <path d="M 304,144 L 336,144" fill="none" stroke="black"></path>
                  <path d="M 336,144 L 360,144" fill="none" stroke="black"></path>
                  <path d="M 272,160 L 296,160" fill="none" stroke="black"></path>
                  <path d="M 304,192 L 352,192" fill="none" stroke="black"></path>
                  <path d="M 272,208 L 296,208" fill="none" stroke="black"></path>
                  <path d="M 304,224 L 336,224" fill="none" stroke="black"></path>
                  <path d="M 336,224 L 360,224" fill="none" stroke="black"></path>
                  <path d="M 304,240 L 328,240" fill="none" stroke="black"></path>
                  <path d="M 344,240 L 376,240" fill="none" stroke="black"></path>
                  <path d="M 56,256 L 96,256" fill="none" stroke="black"></path>
                  <path d="M 112,256 L 120,256" fill="none" stroke="black"></path>
                  <path d="M 136,256 L 200,256" fill="none" stroke="black"></path>
                  <path d="M 88,272 L 104,272" fill="none" stroke="black"></path>
                  <path d="M 104,272 L 144,272" fill="none" stroke="black"></path>
                  <path d="M 144,272 L 200,272" fill="none" stroke="black"></path>
                  <path d="M 200,288 L 240,288" fill="none" stroke="black"></path>
                  <path d="M 16,304 L 32,304" fill="none" stroke="black"></path>
                  <path d="M 208,320 L 320,320" fill="none" stroke="black"></path>
                  <path d="M 88,336 L 128,336" fill="none" stroke="black"></path>
                  <path d="M 128,336 L 144,336" fill="none" stroke="black"></path>
                  <path d="M 144,336 L 160,336" fill="none" stroke="black"></path>
                  <path d="M 160,336 L 200,336" fill="none" stroke="black"></path>
                  <path d="M 56,352 L 200,352" fill="none" stroke="black"></path>
                  <path d="M 0,80 L 0,176" fill="none" stroke="black"></path>
                  <path d="M 0,208 L 0,288" fill="none" stroke="black"></path>
                  <path d="M 40,32 L 40,96" fill="none" stroke="black"></path>
                  <path d="M 40,272 L 40,336" fill="none" stroke="black"></path>
                  <path d="M 88,32 L 88,96" fill="none" stroke="black"></path>
                  <path d="M 88,272 L 88,336" fill="none" stroke="black"></path>
                  <path d="M 104,112 L 104,208" fill="none" stroke="black"></path>
                  <path d="M 104,240 L 104,272" fill="none" stroke="black"></path>
                  <path d="M 128,96 L 128,128" fill="none" stroke="black"></path>
                  <path d="M 128,160 L 128,256" fill="none" stroke="black"></path>
                  <path d="M 144,32 L 144,96" fill="none" stroke="black"></path>
                  <path d="M 144,272 L 144,336" fill="none" stroke="black"></path>
                  <path d="M 200,32 L 200,80" fill="none" stroke="black"></path>
                  <path d="M 200,80 L 200,96" fill="none" stroke="black"></path>
                  <path d="M 200,272 L 200,288" fill="none" stroke="black"></path>
                  <path d="M 200,288 L 200,336" fill="none" stroke="black"></path>
                  <path d="M 216,56 L 216,72" fill="none" stroke="black"></path>
                  <path d="M 216,296 L 216,312" fill="none" stroke="black"></path>
                  <path d="M 256,128 L 256,144" fill="none" stroke="black"></path>
                  <path d="M 256,224 L 256,240" fill="none" stroke="black"></path>
                  <path d="M 288,176 L 288,192" fill="none" stroke="black"></path>
                  <path d="M 304,144 L 304,192" fill="none" stroke="black"></path>
                  <path d="M 304,192 L 304,224" fill="none" stroke="black"></path>
                  <path d="M 336,64 L 336,80" fill="none" stroke="black"></path>
                  <path d="M 336,112 L 336,144" fill="none" stroke="black"></path>
                  <path d="M 336,224 L 336,256" fill="none" stroke="black"></path>
                  <path d="M 336,288 L 336,304" fill="none" stroke="black"></path>
                  <path d="M 360,144 L 360,224" fill="none" stroke="black"></path>
                  <path d="M 392,144 L 392,224" fill="none" stroke="black"></path>
                  <path d="M 216,32 L 216,40" fill="none" stroke="black"></path>
                  <path d="M 216,56 L 216,64" fill="none" stroke="black"></path>
                  <path d="M 216,88 L 216,96" fill="none" stroke="black"></path>
                  <path d="M 216,272 L 216,280" fill="none" stroke="black"></path>
                  <path d="M 216,296 L 216,304" fill="none" stroke="black"></path>
                  <path d="M 216,328 L 216,336" fill="none" stroke="black"></path>
                  <path d="M 288,144 L 288,152" fill="none" stroke="black"></path>
                  <path d="M 288,168 L 288,176" fill="none" stroke="black"></path>
                  <path d="M 288,192 L 288,200" fill="none" stroke="black"></path>
                  <path d="M 288,216 L 288,224" fill="none" stroke="black"></path>
                  <polygon points="40.000000,64.000000 28.000000,58.400002 28.000000,69.599998" transform="rotate(0.000000, 32.000000, 64.000000)" fill="black"></polygon>
                  <polygon points="40.000000,304.000000 28.000000,298.399994 28.000000,309.600006" transform="rotate(0.000000, 32.000000, 304.000000)" fill="black"></polygon>
                  <path d="M 104,104 L 104,112" fill="none" stroke="black"></path>
                  <polygon points="120.000000,112.000000 108.000000,106.400002 108.000000,117.599998" transform="rotate(270.000000, 104.000000, 112.000000)" fill="black"></polygon>
                  <path d="M 128,256 L 128,264" fill="none" stroke="black"></path>
                  <polygon points="144.000000,256.000000 132.000000,250.399994 132.000000,261.600006" transform="rotate(90.000000, 128.000000, 256.000000)" fill="black"></polygon>
                  <polygon points="216.000000,48.000000 204.000000,42.400002 204.000000,53.599998" transform="rotate(180.000000, 208.000000, 48.000000)" fill="black"></polygon>
                  <polygon points="216.000000,320.000000 204.000000,314.399994 204.000000,325.600006" transform="rotate(180.000000, 208.000000, 320.000000)" fill="black"></polygon>
                  <polygon points="304.000000,160.000000 292.000000,154.399994 292.000000,165.600006" transform="rotate(0.000000, 296.000000, 160.000000)" fill="black"></polygon>
                  <polygon points="304.000000,208.000000 292.000000,202.399994 292.000000,213.600006" transform="rotate(0.000000, 296.000000, 208.000000)" fill="black"></polygon>
                  <path d="M 56,16 A 16,16 0 0,0 40,32" fill="none" stroke="black"></path>
                  <path d="M 200,16 A 16,16 0 0,1 216,32" fill="none" stroke="black"></path>
                  <path d="M 320,48 A 16,16 0 0,1 336,64" fill="none" stroke="black"></path>
                  <path d="M 16,64 A 16,16 0 0,0 0,80" fill="none" stroke="black"></path>
                  <path d="M 240,80 A 16,16 0 0,1 256,96" fill="none" stroke="black"></path>
                  <path d="M 40,96 A 16,16 0 0,0 56,112" fill="none" stroke="black"></path>
                  <path d="M 216,96 A 16,16 0 0,1 200,112" fill="none" stroke="black"></path>
                  <path d="M 304,128 A 16,16 0 0,0 288,144" fill="none" stroke="black"></path>
                  <path d="M 376,128 A 16,16 0 0,1 392,144" fill="none" stroke="black"></path>
                  <path d="M 256,144 A 16,16 0 0,0 272,160" fill="none" stroke="black"></path>
                  <path d="M 272,208 A 16,16 0 0,0 256,224" fill="none" stroke="black"></path>
                  <path d="M 288,224 A 16,16 0 0,0 304,240" fill="none" stroke="black"></path>
                  <path d="M 392,224 A 16,16 0 0,1 376,240" fill="none" stroke="black"></path>
                  <path d="M 56,256 A 16,16 0 0,0 40,272" fill="none" stroke="black"></path>
                  <path d="M 200,256 A 16,16 0 0,1 216,272" fill="none" stroke="black"></path>
                  <path d="M 256,272 A 16,16 0 0,1 240,288" fill="none" stroke="black"></path>
                  <path d="M 0,288 A 16,16 0 0,0 16,304" fill="none" stroke="black"></path>
                  <path d="M 336,304 A 16,16 0 0,1 320,320" fill="none" stroke="black"></path>
                  <path d="M 40,336 A 16,16 0 0,0 56,352" fill="none" stroke="black"></path>
                  <path d="M 216,336 A 16,16 0 0,1 200,352" fill="none" stroke="black"></path>
                  <text text-anchor="middle" font-family="monospace" x="0" y="196" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="212" fill="black" font-size="1em">H</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="308" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="308" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="68" fill="black" font-size="1em">P</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="180" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="212" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="308" fill="black" font-size="1em">P</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="308" fill="black" font-size="1em">P</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="324" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="324" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="52" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="52" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="68" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="84" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="116" fill="black" font-size="1em">3</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="212" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="324" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="84" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="180" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="52" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="276" fill="black" font-size="1em">7</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="308" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="164" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="196" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="228" fill="black" font-size="1em">2</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="260" fill="black" font-size="1em">6</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="308" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="68" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="84" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="84" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="164" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="52" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="52" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="52" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="180" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="180" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="308" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="52" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="68" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="68" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="84" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="164" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="180" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="308" fill="black" font-size="1em">H</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="68" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="84" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="148" fill="black" font-size="1em">5</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="164" fill="black" font-size="1em">M</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="308" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="68" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="292" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="100" fill="black" font-size="1em">4</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="212" fill="black" font-size="1em">P</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="308" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="52" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="292" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="68" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="292" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="292" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="308" fill="black" font-size="1em">2</text>
                </g>
              </svg><a href="#section-5.2-6.1.1" class="pilcrow">¶</a>
</div>
</div>
<figcaption><a href="#figure-13" class="selfRef">Figure 13</a>:
<a href="#name-delegation-in-stir" class="selfRef">Delegation in STIR</a>
          </figcaption></figure>
</div>
<p id="section-5.2-7">As shown, the STAR delegation profile described in this document applies
straightforwardly; the only extra requirement being the ability to instruct the
NDC about the allowed TNAuthList values.  This can be achieved by a simple
extension to the CSR template.<a href="#section-5.2-7" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
<div id="iana-considerations">
<section id="section-6">
      <h2 id="name-iana-considerations">
<a href="#section-6" class="section-number selfRef">6. </a><a href="#name-iana-considerations" class="section-name selfRef">IANA Considerations</a>
      </h2>
<div id="new-fields-in-the-meta-object-within-a-directory-object">
<section id="section-6.1">
        <h3 id="name-new-fields-in-the-meta-obje">
<a href="#section-6.1" class="section-number selfRef">6.1. </a><a href="#name-new-fields-in-the-meta-obje" class="section-name selfRef">New Fields in the "meta" Object within a Directory Object</a>
        </h3>
<p id="section-6.1-1">This document adds the following entries to the "ACME Directory Metadata Fields" registry:<a href="#section-6.1-1" class="pilcrow">¶</a></p>
<table class="center" id="table-1">
          <caption><a href="#table-1" class="selfRef">Table 1</a></caption>
<thead>
            <tr>
              <th class="text-left" rowspan="1" colspan="1">Field Name</th>
              <th class="text-left" rowspan="1" colspan="1">Field Type</th>
              <th class="text-left" rowspan="1" colspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">delegation-enabled</td>
              <td class="text-left" rowspan="1" colspan="1">boolean</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">allow-certificate-get</td>
              <td class="text-left" rowspan="1" colspan="1">boolean</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
          </tbody>
        </table>
</section>
</div>
<div id="new-fields-in-the-order-object">
<section id="section-6.2">
        <h3 id="name-new-fields-in-the-order-obj">
<a href="#section-6.2" class="section-number selfRef">6.2. </a><a href="#name-new-fields-in-the-order-obj" class="section-name selfRef">New Fields in the Order Object</a>
        </h3>
<p id="section-6.2-1">This document adds the following entries to the "ACME Order Object Fields" registry:<a href="#section-6.2-1" class="pilcrow">¶</a></p>
<table class="center" id="table-2">
          <caption><a href="#table-2" class="selfRef">Table 2</a></caption>
<thead>
            <tr>
              <th class="text-left" rowspan="1" colspan="1">Field Name</th>
              <th class="text-left" rowspan="1" colspan="1">Field Type</th>
              <th class="text-left" rowspan="1" colspan="1">Configurable</th>
              <th class="text-left" rowspan="1" colspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">allow-certificate-get</td>
              <td class="text-left" rowspan="1" colspan="1">boolean</td>
              <td class="text-left" rowspan="1" colspan="1">true</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">delegation</td>
              <td class="text-left" rowspan="1" colspan="1">string</td>
              <td class="text-left" rowspan="1" colspan="1">true</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
          </tbody>
        </table>
</section>
</div>
<div id="new-fields-in-the-account-object">
<section id="section-6.3">
        <h3 id="name-new-fields-in-the-account-o">
<a href="#section-6.3" class="section-number selfRef">6.3. </a><a href="#name-new-fields-in-the-account-o" class="section-name selfRef">New Fields in the Account Object</a>
        </h3>
<p id="section-6.3-1">This document adds the following entries to the "ACME Account Object Fields" registry:<a href="#section-6.3-1" class="pilcrow">¶</a></p>
<table class="center" id="table-3">
          <caption><a href="#table-3" class="selfRef">Table 3</a></caption>
<thead>
            <tr>
              <th class="text-left" rowspan="1" colspan="1">Field Name</th>
              <th class="text-left" rowspan="1" colspan="1">Field Type</th>
              <th class="text-left" rowspan="1" colspan="1">Requests</th>
              <th class="text-left" rowspan="1" colspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">delegations</td>
              <td class="text-left" rowspan="1" colspan="1">string</td>
              <td class="text-left" rowspan="1" colspan="1">none</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
          </tbody>
        </table>
<p id="section-6.3-3">Note that the <code>delegations</code> field is only reported by ACME servers that have
<code>delegation-enabled</code> set to true in their meta Object.<a href="#section-6.3-3" class="pilcrow">¶</a></p>
</section>
</div>
<div id="new-error-types">
<section id="section-6.4">
        <h3 id="name-new-error-types">
<a href="#section-6.4" class="section-number selfRef">6.4. </a><a href="#name-new-error-types" class="section-name selfRef">New Error Types</a>
        </h3>
<p id="section-6.4-1">This document adds the following entries to the "ACME Error Types" registry:<a href="#section-6.4-1" class="pilcrow">¶</a></p>
<table class="center" id="table-4">
          <caption><a href="#table-4" class="selfRef">Table 4</a></caption>
<thead>
            <tr>
              <th class="text-left" rowspan="1" colspan="1">Type</th>
              <th class="text-left" rowspan="1" colspan="1">Description</th>
              <th class="text-left" rowspan="1" colspan="1">Reference</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">unknownDelegation</td>
              <td class="text-left" rowspan="1" colspan="1">An unknown configuration is listed in the <code>delegation</code> attribute of the order request</td>
              <td class="text-left" rowspan="1" colspan="1">RFC 9115</td>
            </tr>
          </tbody>
        </table>
</section>
</div>
<div id="csr-template-registry">
<section id="section-6.5">
        <h3 id="name-csr-template-extensions">
<a href="#section-6.5" class="section-number selfRef">6.5. </a><a href="#name-csr-template-extensions" class="section-name selfRef">CSR Template Extensions</a>
        </h3>
<p id="section-6.5-1">IANA has established the "STAR Delegation CSR Template
Extensions" registry, with "Specification Required" as its registration procedure.<a href="#section-6.5-1" class="pilcrow">¶</a></p>
<p id="section-6.5-2">Each extension registered must specify:<a href="#section-6.5-2" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-6.5-3.1">an extension name,<a href="#section-6.5-3.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-6.5-3.2">an extension syntax, as a reference to a CDDL document that defines this extension, and<a href="#section-6.5-3.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-6.5-3.3">the extension's mapping into an X.509 certificate extension.<a href="#section-6.5-3.3" class="pilcrow">¶</a>
</li>
        </ul>
<p id="section-6.5-4">The initial contents of this registry are the extensions defined by the CDDL
in <a href="#csr-template-schema-cddl" class="xref">Appendix A</a>.<a href="#section-6.5-4" class="pilcrow">¶</a></p>
<table class="center" id="table-5">
          <caption><a href="#table-5" class="selfRef">Table 5</a></caption>
<thead>
            <tr>
              <th class="text-left" rowspan="1" colspan="1">Extension Name</th>
              <th class="text-left" rowspan="1" colspan="1">Extension Syntax</th>
              <th class="text-left" rowspan="1" colspan="1">Mapping to X.509 Certificate Extension</th>
            </tr>
          </thead>
          <tbody>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">keyUsage</td>
              <td class="text-left" rowspan="1" colspan="1">See <a href="#csr-template-schema-cddl" class="xref">Appendix A</a>
</td>
              <td class="text-left" rowspan="1" colspan="1">
                <span>[<a href="#RFC5280" class="xref">RFC5280</a>], <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3" class="relref">Section 4.2.1.3</a></span>
</td>
            </tr>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">extendedKeyUsage</td>
              <td class="text-left" rowspan="1" colspan="1">See <a href="#csr-template-schema-cddl" class="xref">Appendix A</a>
</td>
              <td class="text-left" rowspan="1" colspan="1">
                <span>[<a href="#RFC5280" class="xref">RFC5280</a>], <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.12" class="relref">Section 4.2.1.12</a></span>
</td>
            </tr>
            <tr>
              <td class="text-left" rowspan="1" colspan="1">subjectAltName</td>
              <td class="text-left" rowspan="1" colspan="1">See <a href="#csr-template-schema-cddl" class="xref">Appendix A</a>
</td>
              <td class="text-left" rowspan="1" colspan="1">
                <span>[<a href="#RFC5280" class="xref">RFC5280</a>], <a href="https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6" class="relref">Section 4.2.1.6</a></span> (note that only specific name formats are allowed: URI, DNS name, email address)</td>
            </tr>
          </tbody>
        </table>
<p id="section-6.5-6">When evaluating a request for an assignment in this registry, the designated expert should follow this guidance:<a href="#section-6.5-6" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-6.5-7.1">The definition must include a full CDDL definition, which the expert will validate.<a href="#section-6.5-7.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-6.5-7.2">The definition must include both positive and negative test cases.<a href="#section-6.5-7.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-6.5-7.3">Additional requirements that are not captured by the CDDL definition are allowed but must be explicitly specified.<a href="#section-6.5-7.3" class="pilcrow">¶</a>
</li>
        </ul>
</section>
</div>
</section>
</div>
<div id="security-considerations">
<section id="section-7">
      <h2 id="name-security-considerations">
<a href="#section-7" class="section-number selfRef">7. </a><a href="#name-security-considerations" class="section-name selfRef">Security Considerations</a>
      </h2>
<div id="sec-trust-model">
<section id="section-7.1">
        <h3 id="name-trust-model">
<a href="#section-7.1" class="section-number selfRef">7.1. </a><a href="#name-trust-model" class="section-name selfRef">Trust Model</a>
        </h3>
<p id="section-7.1-1">The ACME trust model needs to be extended to include the trust relationship
between NDC and IdO.  Note that once this trust link is established, it
potentially becomes recursive.  Therefore, there has to be a trust relationship
between each of the nodes in the delegation chain; for example, in case of
cascading CDNs, this is contractually defined.  Note that when using standard
<span>[<a href="#RFC6125" class="xref">RFC6125</a>]</span> identity verification, there are no mechanisms available to the IdO
to restrict the use of the delegated name once the name has been handed over to
the first NDC.  It is, therefore, expected that contractual measures are in place
to get some assurance that redelegation is not being performed.<a href="#section-7.1-1" class="pilcrow">¶</a></p>
</section>
</div>
<div id="delegation-security-goal">
<section id="section-7.2">
        <h3 id="name-delegation-security-goal">
<a href="#section-7.2" class="section-number selfRef">7.2. </a><a href="#name-delegation-security-goal" class="section-name selfRef">Delegation Security Goal</a>
        </h3>
<p id="section-7.2-1">Delegation introduces a new security goal: only an NDC that has been authorized
by the IdO, either directly or transitively, can obtain a certificate with an
IdO identity.<a href="#section-7.2-1" class="pilcrow">¶</a></p>
<p id="section-7.2-2">From a security point of view, the delegation process has five separate parts:<a href="#section-7.2-2" class="pilcrow">¶</a></p>
<ol start="1" type="1" class="normal type-1" id="section-7.2-3">
   <li id="section-7.2-3.1">enabling a specific third party (the intended NDC) to submit requests for
delegated certificates<a href="#section-7.2-3.1" class="pilcrow">¶</a>
</li>
          <li id="section-7.2-3.2">making sure that any request for a delegated certificate matches the
intended "shape" in terms of delegated identities as well as any other
certificate metadata, e.g., key length, x.509 extensions, etc.<a href="#section-7.2-3.2" class="pilcrow">¶</a>
</li>
          <li id="section-7.2-3.3">serving the certificate back to the NDC<a href="#section-7.2-3.3" class="pilcrow">¶</a>
</li>
          <li id="section-7.2-3.4">handling revocation of the delegation<a href="#section-7.2-3.4" class="pilcrow">¶</a>
</li>
          <li id="section-7.2-3.5">handling revocation of the certificate itself<a href="#section-7.2-3.5" class="pilcrow">¶</a>
</li>
        </ol>
<p id="section-7.2-4">The first part is covered by the NDC's ACME account that is administered by the
IdO, whose security relies on the correct handling of the associated key pair.
When a compromise of the private key is detected, the delegate <span class="bcp14">MUST</span> use the
account deactivation procedures defined in <span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-7.3.6" class="relref">Section 7.3.6</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span>.<a href="#section-7.2-4" class="pilcrow">¶</a></p>
<p id="section-7.2-5">The second part is covered by the act of checking an NDC's certificate request
against the intended CSR template.  The steps of shaping the CSR template
correctly, selecting the right CSR template to check against the presented CSR,
and making sure that the presented CSR matches the selected CSR template are
all security relevant.<a href="#section-7.2-5" class="pilcrow">¶</a></p>
<p id="section-7.2-6">The third part builds on the trust relationship between NDC and IdO that is
responsible for correctly forwarding the certificate URL from the Order
returned by the CA.<a href="#section-7.2-6" class="pilcrow">¶</a></p>
<p id="section-7.2-7">The fourth part is associated with the ability of the IdO to unilaterally
remove the <code>delegation</code> object associated with the revoked identity, therefore,
disabling any further NDC requests for such identity.  Note that, in more
extreme circumstances, the IdO might decide to disable the NDC account,
thus entirely blocking any further interaction.<a href="#section-7.2-7" class="pilcrow">¶</a></p>
<p id="section-7.2-8">The fifth is covered by two different mechanisms, depending on the nature of
the certificate.  For STAR, the IdO shall use the cancellation interface
defined in <span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-2.3" class="relref">Section 2.3</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span>. For non-STAR, the certificate revocation
interface defined in <span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-7.6" class="relref">Section 7.6</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span>) is used.<a href="#section-7.2-8" class="pilcrow">¶</a></p>
<p id="section-7.2-9">The ACME account associated with the delegation plays a crucial role in the
overall security of the presented protocol.  This, in turn, means that (in
delegation scenarios) the security requirements and verification associated with
an ACME account may be more stringent than in base ACME deployments, since the
out-of-band configuration of delegations that an account is authorized to use
(combined with account authentication) takes the place of the normal ACME
authorization challenge procedures.  Therefore, the IdO <span class="bcp14">MUST</span> ensure that
each account is associated with the exact policies (via their matching <code>delegation</code> objects)
that define which domain names can be delegated to the account and how.
The IdO is expected to use out-of-band means to preregister each NDC to
the corresponding account.<a href="#section-7.2-9" class="pilcrow">¶</a></p>
</section>
</div>
<div id="new-acme-channels">
<section id="section-7.3">
        <h3 id="name-new-acme-channels">
<a href="#section-7.3" class="section-number selfRef">7.3. </a><a href="#name-new-acme-channels" class="section-name selfRef">New ACME Channels</a>
        </h3>
<p id="section-7.3-1">Using the model established in <span><a href="https://www.rfc-editor.org/rfc/rfc8555#section-10.1" class="relref">Section 10.1</a> of [<a href="#RFC8555" class="xref">RFC8555</a>]</span>, we can decompose
the interactions of the basic delegation workflow, as shown in
<a href="#fig-sec-channels" class="xref">Figure 14</a>.<a href="#section-7.3-1" class="pilcrow">¶</a></p>
<span id="name-delegation-channels-topolog"></span><div id="fig-sec-channels">
<figure id="figure-14">
          <div id="section-7.3-2.1">
            <div class="artwork art-svg alignLeft" id="section-7.3-2.1.1">
<svg xmlns="http://www.w3.org/2000/svg" class="diagram" version="1.1" viewBox="0 0 756.0 345.0">
                <g transform="translate(8,16)">
                  <path d="M 0,16 L 48,16" fill="none" stroke="black"></path>
                  <path d="M 168,16 L 240,16" fill="none" stroke="black"></path>
                  <path d="M 48,32 L 160,32" fill="none" stroke="black"></path>
                  <path d="M 0,48 L 24,48" fill="none" stroke="black"></path>
                  <path d="M 24,48 L 48,48" fill="none" stroke="black"></path>
                  <path d="M 168,64 L 192,64" fill="none" stroke="black"></path>
                  <path d="M 192,64 L 240,64" fill="none" stroke="black"></path>
                  <path d="M 216,112 L 320,112" fill="none" stroke="black"></path>
                  <path d="M 320,112 L 432,112" fill="none" stroke="black"></path>
                  <path d="M 168,144 L 192,144" fill="none" stroke="black"></path>
                  <path d="M 192,144 L 216,144" fill="none" stroke="black"></path>
                  <path d="M 216,144 L 240,144" fill="none" stroke="black"></path>
                  <path d="M 408,144 L 432,144" fill="none" stroke="black"></path>
                  <path d="M 432,144 L 464,144" fill="none" stroke="black"></path>
                  <path d="M 408,176 L 432,176" fill="none" stroke="black"></path>
                  <path d="M 432,176 L 448,176" fill="none" stroke="black"></path>
                  <path d="M 448,176 L 464,176" fill="none" stroke="black"></path>
                  <path d="M 168,192 L 216,192" fill="none" stroke="black"></path>
                  <path d="M 216,192 L 240,192" fill="none" stroke="black"></path>
                  <path d="M 216,208 L 312,208" fill="none" stroke="black"></path>
                  <path d="M 312,208 L 432,208" fill="none" stroke="black"></path>
                  <path d="M 24,240 L 192,240" fill="none" stroke="black"></path>
                  <path d="M 192,240 L 448,240" fill="none" stroke="black"></path>
                  <path d="M 0,16 L 0,48" fill="none" stroke="black"></path>
                  <path d="M 24,48 L 24,240" fill="none" stroke="black"></path>
                  <path d="M 48,16 L 48,32" fill="none" stroke="black"></path>
                  <path d="M 48,32 L 48,48" fill="none" stroke="black"></path>
                  <path d="M 168,16 L 168,64" fill="none" stroke="black"></path>
                  <path d="M 168,144 L 168,192" fill="none" stroke="black"></path>
                  <path d="M 192,64 L 192,144" fill="none" stroke="black"></path>
                  <path d="M 216,112 L 216,144" fill="none" stroke="black"></path>
                  <path d="M 216,192 L 216,208" fill="none" stroke="black"></path>
                  <path d="M 240,16 L 240,64" fill="none" stroke="black"></path>
                  <path d="M 240,144 L 240,192" fill="none" stroke="black"></path>
                  <path d="M 408,144 L 408,176" fill="none" stroke="black"></path>
                  <path d="M 432,112 L 432,144" fill="none" stroke="black"></path>
                  <path d="M 432,176 L 432,208" fill="none" stroke="black"></path>
                  <path d="M 448,176 L 448,240" fill="none" stroke="black"></path>
                  <path d="M 464,144 L 464,176" fill="none" stroke="black"></path>
                  <polygon points="168.000000,32.000000 156.000000,26.400000 156.000000,37.599998" transform="rotate(0.000000, 160.000000, 32.000000)" fill="black"></polygon>
                  <polygon points="200.000000,240.000000 188.000000,234.399994 188.000000,245.600006" transform="rotate(0.000000, 192.000000, 240.000000)" fill="black"></polygon>
                  <polygon points="320.000000,208.000000 308.000000,202.399994 308.000000,213.600006" transform="rotate(180.000000, 312.000000, 208.000000)" fill="black"></polygon>
                  <polygon points="328.000000,112.000000 316.000000,106.400002 316.000000,117.599998" transform="rotate(0.000000, 320.000000, 112.000000)" fill="black"></polygon>
                  <circle cx="192" cy="64" r="6" fill="white" stroke="black"></circle>
                  <circle cx="192" cy="144" r="6" fill="white" stroke="black"></circle>
                  <text text-anchor="middle" font-family="monospace" x="288" y="228" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="292" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="228" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="248" y="260" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="260" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="292" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="308" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="164" fill="black" font-size="1em">O</text>
                  <text text-anchor="middle" font-family="monospace" x="424" y="292" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="308" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="36" fill="black" font-size="1em">O</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="52" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="100" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="52" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="100" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="164" fill="black" font-size="1em">I</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="228" fill="black" font-size="1em">V</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="292" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="448" y="292" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="488" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="20" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="24" y="36" fill="black" font-size="1em">D</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="180" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="180" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="228" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="260" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="292" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="160" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="292" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="472" y="292" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="308" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="36" fill="black" font-size="1em">I</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="292" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="308" fill="black" font-size="1em">v</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="308" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="228" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="260" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="260" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="292" fill="black" font-size="1em">-</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="36" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="228" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="20" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="296" y="100" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="180" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="292" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="40" y="308" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="52" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="8" y="292" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="32" y="292" fill="black" font-size="1em">U</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="292" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="56" y="308" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="100" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="228" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="80" y="20" fill="black" font-size="1em">M</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="20" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="260" fill="black" font-size="1em">M</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="308" fill="black" font-size="1em">.</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="20" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="228" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="228" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="40" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="464" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="20" fill="black" font-size="1em">E</text>
                  <text text-anchor="middle" font-family="monospace" x="440" y="164" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="260" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="292" fill="black" font-size="1em">f</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="292" fill="black" font-size="1em">S</text>
                  <text text-anchor="middle" font-family="monospace" x="72" y="308" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="288" y="100" fill="black" font-size="1em">M</text>
                  <text text-anchor="middle" font-family="monospace" x="432" y="164" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="228" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="228" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="260" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="256" y="260" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="96" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="292" fill="black" font-size="1em">R</text>
                  <text text-anchor="middle" font-family="monospace" x="136" y="20" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="100" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="292" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="308" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="320" y="100" fill="black" font-size="1em">h</text>
                  <text text-anchor="middle" font-family="monospace" x="336" y="100" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="112" y="260" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="168" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="384" y="292" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="432" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="260" fill="black" font-size="1em">u</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="260" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="260" fill="black" font-size="1em">1</text>
                  <text text-anchor="middle" font-family="monospace" x="16" y="36" fill="black" font-size="1em">N</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="180" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="260" fill="black" font-size="1em">)</text>
                  <text text-anchor="middle" font-family="monospace" x="88" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="292" fill="black" font-size="1em">o</text>
                  <text text-anchor="middle" font-family="monospace" x="416" y="292" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="52" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="328" y="100" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="260" fill="black" font-size="1em">b</text>
                  <text text-anchor="middle" font-family="monospace" x="352" y="292" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="456" y="292" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="20" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="232" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="272" y="228" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="144" y="260" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="240" y="260" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="360" y="100" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="180" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="312" y="228" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="260" fill="black" font-size="1em">A</text>
                  <text text-anchor="middle" font-family="monospace" x="408" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="480" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="20" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="228" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="368" y="228" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="376" y="292" fill="black" font-size="1em">T</text>
                  <text text-anchor="middle" font-family="monospace" x="128" y="20" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="184" y="52" fill="black" font-size="1em">s</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="164" fill="black" font-size="1em">d</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="260" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="48" y="292" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="120" y="292" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="264" y="260" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="280" y="260" fill="black" font-size="1em">e</text>
                  <text text-anchor="middle" font-family="monospace" x="16" y="292" fill="black" font-size="1em">]</text>
                  <text text-anchor="middle" font-family="monospace" x="192" y="292" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="152" y="20" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="100" fill="black" font-size="1em">n</text>
                  <text text-anchor="middle" font-family="monospace" x="392" y="228" fill="black" font-size="1em">l</text>
                  <text text-anchor="middle" font-family="monospace" x="104" y="260" fill="black" font-size="1em">(</text>
                  <text text-anchor="middle" font-family="monospace" x="176" y="292" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="304" y="292" fill="black" font-size="1em">a</text>
                  <text text-anchor="middle" font-family="monospace" x="440" y="292" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="200" y="180" fill="black" font-size="1em">i</text>
                  <text text-anchor="middle" font-family="monospace" x="0" y="292" fill="black" font-size="1em">[</text>
                  <text text-anchor="middle" font-family="monospace" x="64" y="292" fill="black" font-size="1em">t</text>
                  <text text-anchor="middle" font-family="monospace" x="32" y="36" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="208" y="260" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="216" y="292" fill="black" font-size="1em">c</text>
                  <text text-anchor="middle" font-family="monospace" x="32" y="308" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="52" fill="black" font-size="1em">r</text>
                  <text text-anchor="middle" font-family="monospace" x="344" y="228" fill="black" font-size="1em">C</text>
                  <text text-anchor="middle" font-family="monospace" x="224" y="260" fill="black" font-size="1em">E</text>
                </g>
              </svg><a href="#section-7.3-2.1.1" class="pilcrow">¶</a>
</div>
</div>
<figcaption><a href="#figure-14" class="selfRef">Figure 14</a>:
<a href="#name-delegation-channels-topolog" class="selfRef">Delegation Channels Topology</a>
          </figcaption></figure>
</div>
<p id="section-7.3-3">The considerations regarding the security of the ACME Channel and Validation
Channel discussed in <span>[<a href="#RFC8555" class="xref">RFC8555</a>]</span> apply verbatim to the IdO-CA leg.
The same can be said for the ACME Channel on the NDC-IdO leg.  A slightly
different set of considerations apply to the ACME Channel between the NDC and CA,
which consists of a subset of the ACME interface comprising two API
endpoints: the unauthenticated certificate retrieval and, potentially, non-STAR
revocation via certificate private key.  No specific security considerations
apply to the former, but the privacy considerations in
<span><a href="https://www.rfc-editor.org/rfc/rfc8739#section-6.3" class="relref">Section 6.3</a> of [<a href="#RFC8739" class="xref">RFC8739</a>]</span> do.  With regard to the latter, it should be noted that there is
currently no means for an IdO to disable authorizing revocation based on
certificate private keys.  So, in theory, an NDC could use the revocation API
directly with the CA, therefore, bypassing the IdO.  The NDC <span class="bcp14">SHOULD NOT</span>
directly use the revocation interface exposed by the CA unless failing
to do so would compromise the overall security, for example, if the certificate
private key is compromised and the IdO is not currently reachable.<a href="#section-7.3-3" class="pilcrow">¶</a></p>
<p id="section-7.3-4">All other security considerations from <span>[<a href="#RFC8555" class="xref">RFC8555</a>]</span> and <span>[<a href="#RFC8739" class="xref">RFC8739</a>]</span> apply
as is to the delegation topology.<a href="#section-7.3-4" class="pilcrow">¶</a></p>
</section>
</div>
<div id="restricting-cdns-to-the-delegation-mechanism">
<section id="section-7.4">
        <h3 id="name-restricting-cdns-to-the-del">
<a href="#section-7.4" class="section-number selfRef">7.4. </a><a href="#name-restricting-cdns-to-the-del" class="section-name selfRef">Restricting CDNs to the Delegation Mechanism</a>
        </h3>
<p id="section-7.4-1">When a website is delegated to a CDN, the CDN can in principle modify the website at will, e.g., create and remove pages. This means that a malicious or breached
CDN can pass the ACME (as well as common non-ACME) HTTPS-based validation
challenges and generate a certificate for the site. This is true regardless of
whether or not the CNAME mechanisms defined in the current document is used.<a href="#section-7.4-1" class="pilcrow">¶</a></p>
<p id="section-7.4-2">In some cases, this is the desired behavior; the domain holder trusts the CDN to
have full control of the cryptographic credentials for the site. However, this
document assumes a scenario where the domain holder only wants to delegate
restricted control and wishes to retain the capability to cancel the CDN's
credentials at a short notice.<a href="#section-7.4-2" class="pilcrow">¶</a></p>
<p id="section-7.4-3">The following is a possible mitigation when the IdO wishes to ensure that a
rogue CDN cannot issue unauthorized certificates:<a href="#section-7.4-3" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="section-7.4-4.1">The domain holder makes sure that the CDN cannot modify the DNS records for
the domain.  The domain holder should ensure it is the only entity authorized
to modify the DNS zone. Typically, it establishes a CNAME resource record
from a subdomain into a CDN-managed domain.<a href="#section-7.4-4.1" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-7.4-4.2">The domain holder uses a Certification Authority Authorization (CAA) record <span>[<a href="#RFC8659" class="xref">RFC8659</a>]</span> to restrict certificate
issuance for the domain to specific CAs that comply with ACME and are known
to implement <span>[<a href="#RFC8657" class="xref">RFC8657</a>]</span>.<a href="#section-7.4-4.2" class="pilcrow">¶</a>
</li>
          <li class="normal" id="section-7.4-4.3">The domain holder uses the ACME-specific CAA mechanism <span>[<a href="#RFC8657" class="xref">RFC8657</a>]</span> to
restrict issuance to a specific CA account that is controlled by it and
<span class="bcp14">MUST</span> require "dns-01" as the sole validation method.<a href="#section-7.4-4.3" class="pilcrow">¶</a>
</li>
        </ul>
<p id="section-7.4-5">We note that the above solution may need to be tweaked depending on the exact
capabilities and authorization flows supported by the selected CA.
In addition, this mitigation may be bypassed if a malicious or misconfigured CA
does not comply with CAA restrictions.<a href="#section-7.4-5" class="pilcrow">¶</a></p>
</section>
</div>
</section>
</div>
<section id="section-8">
      <h2 id="name-references">
<a href="#section-8" class="section-number selfRef">8. </a><a href="#name-references" class="section-name selfRef">References</a>
      </h2>
<section id="section-8.1">
        <h3 id="name-normative-references">
<a href="#section-8.1" class="section-number selfRef">8.1. </a><a href="#name-normative-references" class="section-name selfRef">Normative References</a>
        </h3>
<dl class="references">
<dt id="RFC2119">[RFC2119]</dt>
        <dd>
<span class="refAuthor">Bradner, S.</span>, <span class="refTitle">"Key words for use in RFCs to Indicate Requirement Levels"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 2119</span>, <span class="seriesInfo">DOI 10.17487/RFC2119</span>, <time datetime="1997-03" class="refDate">March 1997</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc2119">https://www.rfc-editor.org/info/rfc2119</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC2986">[RFC2986]</dt>
        <dd>
<span class="refAuthor">Nystrom, M.</span> and <span class="refAuthor">B. Kaliski</span>, <span class="refTitle">"PKCS #10: Certification Request Syntax Specification Version 1.7"</span>, <span class="seriesInfo">RFC 2986</span>, <span class="seriesInfo">DOI 10.17487/RFC2986</span>, <time datetime="2000-11" class="refDate">November 2000</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc2986">https://www.rfc-editor.org/info/rfc2986</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC5280">[RFC5280]</dt>
        <dd>
<span class="refAuthor">Cooper, D.</span>, <span class="refAuthor">Santesson, S.</span>, <span class="refAuthor">Farrell, S.</span>, <span class="refAuthor">Boeyen, S.</span>, <span class="refAuthor">Housley, R.</span>, and <span class="refAuthor">W. Polk</span>, <span class="refTitle">"Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile"</span>, <span class="seriesInfo">RFC 5280</span>, <span class="seriesInfo">DOI 10.17487/RFC5280</span>, <time datetime="2008-05" class="refDate">May 2008</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc5280">https://www.rfc-editor.org/info/rfc5280</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC7807">[RFC7807]</dt>
        <dd>
<span class="refAuthor">Nottingham, M.</span> and <span class="refAuthor">E. Wilde</span>, <span class="refTitle">"Problem Details for HTTP APIs"</span>, <span class="seriesInfo">RFC 7807</span>, <span class="seriesInfo">DOI 10.17487/RFC7807</span>, <time datetime="2016-03" class="refDate">March 2016</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc7807">https://www.rfc-editor.org/info/rfc7807</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8174">[RFC8174]</dt>
        <dd>
<span class="refAuthor">Leiba, B.</span>, <span class="refTitle">"Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words"</span>, <span class="seriesInfo">BCP 14</span>, <span class="seriesInfo">RFC 8174</span>, <span class="seriesInfo">DOI 10.17487/RFC8174</span>, <time datetime="2017-05" class="refDate">May 2017</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8174">https://www.rfc-editor.org/info/rfc8174</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8555">[RFC8555]</dt>
        <dd>
<span class="refAuthor">Barnes, R.</span>, <span class="refAuthor">Hoffman-Andrews, J.</span>, <span class="refAuthor">McCarney, D.</span>, and <span class="refAuthor">J. Kasten</span>, <span class="refTitle">"Automatic Certificate Management Environment (ACME)"</span>, <span class="seriesInfo">RFC 8555</span>, <span class="seriesInfo">DOI 10.17487/RFC8555</span>, <time datetime="2019-03" class="refDate">March 2019</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8555">https://www.rfc-editor.org/info/rfc8555</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8610">[RFC8610]</dt>
        <dd>
<span class="refAuthor">Birkholz, H.</span>, <span class="refAuthor">Vigano, C.</span>, and <span class="refAuthor">C. Bormann</span>, <span class="refTitle">"Concise Data Definition Language (CDDL): A Notational Convention to Express Concise Binary Object Representation (CBOR) and JSON Data Structures"</span>, <span class="seriesInfo">RFC 8610</span>, <span class="seriesInfo">DOI 10.17487/RFC8610</span>, <time datetime="2019-06" class="refDate">June 2019</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8610">https://www.rfc-editor.org/info/rfc8610</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8739">[RFC8739]</dt>
      <dd>
<span class="refAuthor">Sheffer, Y.</span>, <span class="refAuthor">Lopez, D.</span>, <span class="refAuthor">Gonzalez de Dios, O.</span>, <span class="refAuthor">Pastor Perales, A.</span>, and <span class="refAuthor">T. Fossati</span>, <span class="refTitle">"Support for Short-Term, Automatically Renewed (STAR) Certificates in the Automated Certificate Management Environment (ACME)"</span>, <span class="seriesInfo">RFC 8739</span>, <span class="seriesInfo">DOI 10.17487/RFC8739</span>, <time datetime="2020-03" class="refDate">March 2020</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8739">https://www.rfc-editor.org/info/rfc8739</a>&gt;</span>. </dd>
<dd class="break"></dd>
</dl>
</section>
<section id="section-8.2">
        <h3 id="name-informative-references">
<a href="#section-8.2" class="section-number selfRef">8.2. </a><a href="#name-informative-references" class="section-name selfRef">Informative References</a>
        </h3>
<dl class="references">
<dt id="I-D.ietf-cdni-interfaces-https-delegation">[HTTPS-DELEGATION]</dt>
        <dd>
<span class="refAuthor">Fieau, F.</span>, <span class="refAuthor">Stephan, E.</span>, and <span class="refAuthor">S. Mishra</span>, <span class="refTitle">"CDNI extensions for HTTPS delegation"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-ietf-cdni-interfaces-https-delegation-06</span>, <time datetime="2021-09-10" class="refDate">10 September 2021</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-ietf-cdni-interfaces-https-delegation-06">https://datatracker.ietf.org/doc/html/draft-ietf-cdni-interfaces-https-delegation-06</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="I-D.handrews-json-schema-validation">[json-schema-07]</dt>
        <dd>
<span class="refAuthor">Wright, A.</span>, <span class="refAuthor">Andrews, H.</span>, and <span class="refAuthor">B. Hutton</span>, <span class="refTitle">"JSON Schema Validation: A Vocabulary for Structural Validation of JSON"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-handrews-json-schema-validation-02</span>, <time datetime="2019-09-17" class="refDate">17 September 2019</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-handrews-json-schema-validation-02">https://datatracker.ietf.org/doc/html/draft-handrews-json-schema-validation-02</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="I-D.mglt-lurk-tls13">[MGLT-LURK-TLS13]</dt>
        <dd>
<span class="refAuthor">Migault, D.</span>, <span class="refTitle">"LURK Extension version 1 for (D)TLS 1.3 Authentication"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-mglt-lurk-tls13-05</span>, <time datetime="2021-07-26" class="refDate">26 July 2021</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-mglt-lurk-tls13-05">https://datatracker.ietf.org/doc/html/draft-mglt-lurk-tls13-05</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC6125">[RFC6125]</dt>
        <dd>
<span class="refAuthor">Saint-Andre, P.</span> and <span class="refAuthor">J. Hodges</span>, <span class="refTitle">"Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)"</span>, <span class="seriesInfo">RFC 6125</span>, <span class="seriesInfo">DOI 10.17487/RFC6125</span>, <time datetime="2011-03" class="refDate">March 2011</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc6125">https://www.rfc-editor.org/info/rfc6125</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC7336">[RFC7336]</dt>
        <dd>
<span class="refAuthor">Peterson, L.</span>, <span class="refAuthor">Davie, B.</span>, and <span class="refAuthor">R. van Brandenburg, Ed.</span>, <span class="refTitle">"Framework for Content Distribution Network Interconnection (CDNI)"</span>, <span class="seriesInfo">RFC 7336</span>, <span class="seriesInfo">DOI 10.17487/RFC7336</span>, <time datetime="2014-08" class="refDate">August 2014</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc7336">https://www.rfc-editor.org/info/rfc7336</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8225">[RFC8225]</dt>
        <dd>
<span class="refAuthor">Wendt, C.</span> and <span class="refAuthor">J. Peterson</span>, <span class="refTitle">"PASSporT: Personal Assertion Token"</span>, <span class="seriesInfo">RFC 8225</span>, <span class="seriesInfo">DOI 10.17487/RFC8225</span>, <time datetime="2018-02" class="refDate">February 2018</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8225">https://www.rfc-editor.org/info/rfc8225</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8226">[RFC8226]</dt>
        <dd>
<span class="refAuthor">Peterson, J.</span> and <span class="refAuthor">S. Turner</span>, <span class="refTitle">"Secure Telephone Identity Credentials: Certificates"</span>, <span class="seriesInfo">RFC 8226</span>, <span class="seriesInfo">DOI 10.17487/RFC8226</span>, <time datetime="2018-02" class="refDate">February 2018</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8226">https://www.rfc-editor.org/info/rfc8226</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8657">[RFC8657]</dt>
        <dd>
<span class="refAuthor">Landau, H.</span>, <span class="refTitle">"Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding"</span>, <span class="seriesInfo">RFC 8657</span>, <span class="seriesInfo">DOI 10.17487/RFC8657</span>, <time datetime="2019-11" class="refDate">November 2019</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8657">https://www.rfc-editor.org/info/rfc8657</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC8659">[RFC8659]</dt>
        <dd>
<span class="refAuthor">Hallam-Baker, P.</span>, <span class="refAuthor">Stradling, R.</span>, and <span class="refAuthor">J. Hoffman-Andrews</span>, <span class="refTitle">"DNS Certification Authority Authorization (CAA) Resource Record"</span>, <span class="seriesInfo">RFC 8659</span>, <span class="seriesInfo">DOI 10.17487/RFC8659</span>, <time datetime="2019-11" class="refDate">November 2019</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc8659">https://www.rfc-editor.org/info/rfc8659</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="RFC9060">[RFC9060]</dt>
        <dd>
<span class="refAuthor">Peterson, J.</span>, <span class="refTitle">"Secure Telephone Identity Revisited (STIR) Certificate Delegation"</span>, <span class="seriesInfo">RFC 9060</span>, <span class="seriesInfo">DOI 10.17487/RFC9060</span>, <time datetime="2021-09" class="refDate">September 2021</time>, <span>&lt;<a href="https://www.rfc-editor.org/info/rfc9060">https://www.rfc-editor.org/info/rfc9060</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="I-D.ietf-tls-subcerts">[TLS-SUBCERTS]</dt>
        <dd>
<span class="refAuthor">Barnes, R.</span>, <span class="refAuthor">Iyengar, S.</span>, <span class="refAuthor">Sullivan, N.</span>, and <span class="refAuthor">E. Rescorla</span>, <span class="refTitle">"Delegated Credentials for TLS"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-ietf-tls-subcerts-10</span>, <time datetime="2021-01-24" class="refDate">24 January 2021</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-ietf-tls-subcerts-10">https://datatracker.ietf.org/doc/html/draft-ietf-tls-subcerts-10</a>&gt;</span>. </dd>
<dd class="break"></dd>
<dt id="I-D.ietf-acme-authority-token-tnauthlist">[TOKEN-TNAUTHLIST]</dt>
      <dd>
<span class="refAuthor">Wendt, C.</span>, <span class="refAuthor">Hancock, D.</span>, <span class="refAuthor">Barnes, M.</span>, and <span class="refAuthor">J. Peterson</span>, <span class="refTitle">"TNAuthList profile of ACME Authority Token"</span>, <span class="refContent">Work in Progress</span>, <span class="seriesInfo">Internet-Draft, draft-ietf-acme-authority-token-tnauthlist-08</span>, <time datetime="2021-03-27" class="refDate">27 March 2021</time>, <span>&lt;<a href="https://datatracker.ietf.org/doc/html/draft-ietf-acme-authority-token-tnauthlist-08">https://datatracker.ietf.org/doc/html/draft-ietf-acme-authority-token-tnauthlist-08</a>&gt;</span>. </dd>
<dd class="break"></dd>
</dl>
</section>
</section>
<div id="csr-template-schema-cddl">
<section id="appendix-A">
      <h2 id="name-csr-template-cddl">
<a href="#appendix-A" class="section-number selfRef">Appendix A. </a><a href="#name-csr-template-cddl" class="section-name selfRef">CSR Template: CDDL</a>
      </h2>
<p id="appendix-A-1">Following is the normative definition of the CSR template using CDDL <span>[<a href="#RFC8610" class="xref">RFC8610</a>]</span>. The CSR template <span class="bcp14">MUST</span> be a valid JSON document that is compliant with the syntax defined here.<a href="#appendix-A-1" class="pilcrow">¶</a></p>
<p id="appendix-A-2">There are additional constraints not expressed in CDDL that <span class="bcp14">MUST</span> be validated
by the recipient, including:<a href="#appendix-A-2" class="pilcrow">¶</a></p>
<ul class="normal">
<li class="normal" id="appendix-A-3.1">the value of each <code>subjectAltName</code> entry is compatible with its type and<a href="#appendix-A-3.1" class="pilcrow">¶</a>
</li>
        <li class="normal" id="appendix-A-3.2">the parameters in each <code>keyTypes</code> entry form an acceptable combination.<a href="#appendix-A-3.2" class="pilcrow">¶</a>
</li>
      </ul>
<div id="appendix-A-4">
<pre class="sourcecode lang-cddl">
csr-template-schema = {
  keyTypes: [ + $keyType ]
  ? subject: non-empty&lt;distinguishedName&gt;
  extensions: extensions
}

non-empty&lt;M&gt; = (M) .and ({ + any =&gt; any })

mandatory-wildcard = "**"
optional-wildcard = "*"
wildcard = mandatory-wildcard / optional-wildcard

; regtext matches all text strings but "*" and "**"
regtext = text .regexp "([^\*].*)|([\*][^\*].*)|([\*][\*].+)"

regtext-or-wildcard = regtext / wildcard

distinguishedName = {
  ? country: regtext-or-wildcard
  ? stateOrProvince: regtext-or-wildcard
  ? locality: regtext-or-wildcard
  ? organization: regtext-or-wildcard
  ? organizationalUnit: regtext-or-wildcard
  ? emailAddress: regtext-or-wildcard
  ? commonName: regtext-or-wildcard
}

$keyType /= rsaKeyType
$keyType /= ecdsaKeyType

rsaKeyType = {
  PublicKeyType: "rsaEncryption" ; OID: 1.2.840.113549.1.1.1
  PublicKeyLength: rsaKeySize
  SignatureType: $rsaSignatureType
}

rsaKeySize = uint

; RSASSA-PKCS1-v1_5 with SHA-256
$rsaSignatureType /= "sha256WithRSAEncryption"
; RSASSA-PCKS1-v1_5 with SHA-384
$rsaSignatureType /= "sha384WithRSAEncryption"
; RSASSA-PCKS1-v1_5 with SHA-512
$rsaSignatureType /= "sha512WithRSAEncryption"
; RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a 32 byte salt
$rsaSignatureType /= "sha256WithRSAandMGF1"
; RSASSA-PSS with SHA-384, MGF-1 with SHA-384, and a 48 byte salt
$rsaSignatureType /= "sha384WithRSAandMGF1"
; RSASSA-PSS with SHA-512, MGF-1 with SHA-512, and a 64 byte salt
$rsaSignatureType /= "sha512WithRSAandMGF1"

ecdsaKeyType = {
  PublicKeyType: "id-ecPublicKey" ; OID: 1.2.840.10045.2.1
  namedCurve: $ecdsaCurve
  SignatureType: $ecdsaSignatureType
}

$ecdsaCurve /= "secp256r1" ; OID: 1.2.840.10045.3.1.7
$ecdsaCurve /= "secp384r1" ; OID: 1.3.132.0.34
$ecdsaCurve /= "secp521r1" ; OID: 1.3.132.0.3

$ecdsaSignatureType /= "ecdsa-with-SHA256" ; paired with secp256r1
$ecdsaSignatureType /= "ecdsa-with-SHA384" ; paired with secp384r1
$ecdsaSignatureType /= "ecdsa-with-SHA512" ; paired with secp521r1

subjectaltname = {
  ? DNS: [ + regtext-or-wildcard ]
  ? Email: [ + regtext ]
  ? URI: [ + regtext ]
  * $$subjectaltname-extension
}

extensions = {
  ? keyUsage: [ + keyUsageType ]
  ? extendedKeyUsage: [ + extendedKeyUsageType ]
  subjectAltName: non-empty&lt;subjectaltname&gt;
}

keyUsageType /= "digitalSignature"
keyUsageType /= "nonRepudiation"
keyUsageType /= "keyEncipherment"
keyUsageType /= "dataEncipherment"
keyUsageType /= "keyAgreement"
keyUsageType /= "keyCertSign"
keyUsageType /= "cRLSign"
keyUsageType /= "encipherOnly"
keyUsageType /= "decipherOnly"

extendedKeyUsageType /= "serverAuth"
extendedKeyUsageType /= "clientAuth"
extendedKeyUsageType /= "codeSigning"
extendedKeyUsageType /= "emailProtection"
extendedKeyUsageType /= "timeStamping"
extendedKeyUsageType /= "OCSPSigning"
extendedKeyUsageType /= oid

oid = text .regexp "([0-2])((\.0)|(\.[1-9][0-9]*))*"

</pre><a href="#appendix-A-4" class="pilcrow">¶</a>
</div>
</section>
</div>
<div id="csr-template-schema">
<section id="appendix-B">
      <h2 id="name-csr-template-json-schema">
<a href="#appendix-B" class="section-number selfRef">Appendix B. </a><a href="#name-csr-template-json-schema" class="section-name selfRef">CSR Template: JSON Schema</a>
      </h2>
<p id="appendix-B-1">This appendix includes an alternative, nonnormative JSON Schema definition of the CSR template. The syntax used is that of draft 7 of JSON Schema, which is documented in <span>[<a href="#I-D.handrews-json-schema-validation" class="xref">json-schema-07</a>]</span>. Note that later versions of this (now-expired) draft describe later versions of the JSON Schema syntax. At the time of writing, a stable reference for this syntax is not yet available, and we have chosen to use the draft version, which is currently best supported by tool implementations.<a href="#appendix-B-1" class="pilcrow">¶</a></p>
<p id="appendix-B-2">The same considerations about additional constraints checking discussed in
<a href="#csr-template-schema-cddl" class="xref">Appendix A</a> apply here as well.<a href="#appendix-B-2" class="pilcrow">¶</a></p>
<div id="appendix-B-3">
<pre class="sourcecode lang-json">
{
  "title": "JSON Schema for the STAR Delegation CSR template",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "http://ietf.org/acme/drafts/star-delegation/csr-template",
  "$defs": {
    "distinguished-name": {
      "$id": "#distinguished-name",
      "type": "object",
      "minProperties": 1,
      "properties": {
        "country": {
          "type": "string"
        },
        "stateOrProvince": {
          "type": "string"
        },
        "locality": {
          "type": "string"
        },
        "organization": {
          "type": "string"
        },
        "organizationalUnit": {
          "type": "string"
        },
        "emailAddress": {
          "type": "string"
        },
        "commonName": {
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "rsaKeyType": {
      "$id": "#rsaKeyType",
      "type": "object",
      "properties": {
        "PublicKeyType": {
          "type": "string",
          "const": "rsaEncryption"
        },
        "PublicKeyLength": {
          "type": "integer"
        },
        "SignatureType": {
          "type": "string",
          "enum": [
            "sha256WithRSAEncryption",
            "sha384WithRSAEncryption",
            "sha512WithRSAEncryption",
            "sha256WithRSAandMGF1",
            "sha384WithRSAandMGF1",
            "sha512WithRSAandMGF1"
          ]
        }
      },
      "required": [
        "PublicKeyType",
        "PublicKeyLength",
        "SignatureType"
      ],
      "additionalProperties": false
    },
    "ecdsaKeyType": {
      "$id": "#ecdsaKeyType",
      "type": "object",
      "properties": {
        "PublicKeyType": {
          "type": "string",
          "const": "id-ecPublicKey"
        },
        "namedCurve": {
          "type": "string",
          "enum": [
            "secp256r1",
            "secp384r1",
            "secp521r1"
          ]
        },
        "SignatureType": {
          "type": "string",
          "enum": [
            "ecdsa-with-SHA256",
            "ecdsa-with-SHA384",
            "ecdsa-with-SHA512"
          ]
        }
      },
      "required": [
        "PublicKeyType",
        "namedCurve",
        "SignatureType"
      ],
      "additionalProperties": false
    }
  },
  "type": "object",
  "properties": {
    "keyTypes": {
      "type": "array",
      "minItems": 1,
      "items": {
        "anyOf": [
          {
            "$ref": "#rsaKeyType"
          },
          {
            "$ref": "#ecdsaKeyType"
          }
        ]
      }
    },
    "subject": {
      "$ref": "#distinguished-name"
    },
    "extensions": {
      "type": "object",
      "properties": {
        "keyUsage": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "string",
            "enum": [
              "digitalSignature",
              "nonRepudiation",
              "keyEncipherment",
              "dataEncipherment",
              "keyAgreement",
              "keyCertSign",
              "cRLSign",
              "encipherOnly",
              "decipherOnly"
            ]
          }
        },
        "extendedKeyUsage": {
          "type": "array",
          "minItems": 1,
          "items": {
            "anyOf": [
              {
                "type": "string",
                "enum": [
                  "serverAuth",
                  "clientAuth",
                  "codeSigning",
                  "emailProtection",
                  "timeStamping",
                  "OCSPSigning"
                ]
              },
              {
                "type": "string",
                "pattern": "^([0-2])((\\.0)|(\\.[1-9][0-9]*))*$",
                "description": "Used for OID values"
              }
            ]
          }
        },
        "subjectAltName": {
          "type": "object",
          "minProperties": 1,
          "properties": {
            "DNS": {
              "type": "array",
              "minItems": 1,
              "items": {
                "anyOf": [
                  {
                    "type": "string",
                    "enum": [
                      "*",
                      "**"
                    ]
                  },
                  {
                    "type": "string",
                    "format": "hostname"
                  }
                ]
              }
            },
            "Email": {
              "type": "array",
              "minItems": 1,
              "items": {
                "type": "string",
                "format": "email"
              }
            },
            "URI": {
              "type": "array",
              "minItems": 1,
              "items": {
                "type": "string",
                "format": "uri"
              }
            }
          },
          "additionalProperties": false
        }
      },
      "required": [
        "subjectAltName"
      ],
      "additionalProperties": false
    }
  },
  "required": [
    "extensions",
    "keyTypes"
  ],
  "additionalProperties": false
}

</pre><a href="#appendix-B-3" class="pilcrow">¶</a>
</div>
</section>
</div>
<div id="acknowledgements">
<section id="appendix-C">
      <h2 id="name-acknowledgements">
<a href="#name-acknowledgements" class="section-name selfRef">Acknowledgements</a>
      </h2>
<p id="appendix-C-1">We would like to thank the following people who contributed significantly to this document with their review comments and design proposals: <span class="contact-name">Richard Barnes</span>, <span class="contact-name">Carsten Bormann</span>, <span class="contact-name">Roman Danyliw</span>, <span class="contact-name">Lars Eggert</span>, <span class="contact-name">Frédéric Fieau</span>, <span class="contact-name">Russ Housley</span>, <span class="contact-name">Ben Kaduk</span>, <span class="contact-name">Eric Kline</span>, <span class="contact-name">Sanjay Mishra</span>, <span class="contact-name">Francesca Palombini</span>, <span class="contact-name">Jon Peterson</span>, <span class="contact-name">Ryan Sleevi</span>, <span class="contact-name">Emile Stephan</span>, and <span class="contact-name">Éric Vyncke</span>.<a href="#appendix-C-1" class="pilcrow">¶</a></p>
<p id="appendix-C-2">This work is partially supported by the European Commission under Horizon 2020
grant agreement no. 688421 Measurement and Architecture for a Middleboxed
Internet (MAMI). This support does not imply endorsement.<a href="#appendix-C-2" class="pilcrow">¶</a></p>
</section>
</div>
<div id="authors-addresses">
<section id="appendix-D">
      <h2 id="name-authors-addresses">
<a href="#name-authors-addresses" class="section-name selfRef">Authors' Addresses</a>
      </h2>
<address class="vcard">
        <div dir="auto" class="left"><span class="fn nameRole">Yaron Sheffer</span></div>
<div dir="auto" class="left"><span class="org">Intuit</span></div>
<div class="email">
<span>Email:</span>
<a href="mailto:yaronf.ietf@gmail.com" class="email">yaronf.ietf@gmail.com</a>
</div>
</address>
<address class="vcard">
        <div dir="auto" class="left"><span class="fn nameRole">Diego López</span></div>
<div dir="auto" class="left"><span class="org">Telefonica I+D</span></div>
<div class="email">
<span>Email:</span>
<a href="mailto:diego.r.lopez@telefonica.com" class="email">diego.r.lopez@telefonica.com</a>
</div>
</address>
<address class="vcard">
        <div dir="auto" class="left"><span class="fn nameRole">Antonio Agustín Pastor Perales</span></div>
<div dir="auto" class="left"><span class="org">Telefonica I+D</span></div>
<div class="email">
<span>Email:</span>
<a href="mailto:antonio.pastorperales@telefonica.com" class="email">antonio.pastorperales@telefonica.com</a>
</div>
</address>
<address class="vcard">
        <div dir="auto" class="left"><span class="fn nameRole">Thomas Fossati</span></div>
<div dir="auto" class="left"><span class="org">ARM</span></div>
<div class="email">
<span>Email:</span>
<a href="mailto:thomas.fossati@arm.com" class="email">thomas.fossati@arm.com</a>
</div>
</address>
</section>
</div>
<script>const toc = document.getElementById("toc");
toc.querySelector("h2").addEventListener("click", e => {
  toc.classList.toggle("active");
});
toc.querySelector("nav").addEventListener("click", e => {
  toc.classList.remove("active");
});
</script>
</body>
</html>