{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/31","labels_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/31/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/31/comments","events_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/31/events","html_url":"https://github.com/letsencrypt/acme-spec/issues/31","id":50256642,"number":31,"title":"proof of control: host ssh keys?","user":{"login":"dnozay","id":205466,"avatar_url":"https://avatars.githubusercontent.com/u/205466?v=3","gravatar_id":"","url":"https://api.github.com/users/dnozay","html_url":"https://github.com/dnozay","followers_url":"https://api.github.com/users/dnozay/followers","following_url":"https://api.github.com/users/dnozay/following{/other_user}","gists_url":"https://api.github.com/users/dnozay/gists{/gist_id}","starred_url":"https://api.github.com/users/dnozay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dnozay/subscriptions","organizations_url":"https://api.github.com/users/dnozay/orgs","repos_url":"https://api.github.com/users/dnozay/repos","events_url":"https://api.github.com/users/dnozay/events{/privacy}","received_events_url":"https://api.github.com/users/dnozay/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/letsencrypt/acme-spec/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/letsencrypt/acme-spec/milestones/3","html_url":"https://github.com/letsencrypt/acme-spec/milestones/Defer","labels_url":"https://api.github.com/repos/letsencrypt/acme-spec/milestones/3/labels","id":1178713,"number":3,"title":"Defer","description":"Issues we would like to resolve but have no particular deadline.","creator":{"login":"bdaehlie","id":84762,"avatar_url":"https://avatars.githubusercontent.com/u/84762?v=3","gravatar_id":"","url":"https://api.github.com/users/bdaehlie","html_url":"https://github.com/bdaehlie","followers_url":"https://api.github.com/users/bdaehlie/followers","following_url":"https://api.github.com/users/bdaehlie/following{/other_user}","gists_url":"https://api.github.com/users/bdaehlie/gists{/gist_id}","starred_url":"https://api.github.com/users/bdaehlie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdaehlie/subscriptions","organizations_url":"https://api.github.com/users/bdaehlie/orgs","repos_url":"https://api.github.com/users/bdaehlie/repos","events_url":"https://api.github.com/users/bdaehlie/events{/privacy}","received_events_url":"https://api.github.com/users/bdaehlie/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":2,"state":"open","created_at":"2015-06-24T06:42:34Z","updated_at":"2015-07-08T22:28:10Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2014-11-27T05:51:39Z","updated_at":"2015-09-22T08:08:55Z","closed_at":null,"body":"Hi, would a challenge based on knowing the host ssh keys be possible ?\r\n(or even a good idea?)\r\n\r\nScenario: host is configured with puppet, puppet knows/generates host ssh keys ahead of time and we want to run the client & generate certs ahead of time."},"comment":{"url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/comments/142208068","html_url":"https://github.com/letsencrypt/acme-spec/issues/31#issuecomment-142208068","issue_url":"https://api.github.com/repos/letsencrypt/acme-spec/issues/31","id":142208068,"user":{"login":"mvdkleijn","id":431452,"avatar_url":"https://avatars.githubusercontent.com/u/431452?v=3","gravatar_id":"","url":"https://api.github.com/users/mvdkleijn","html_url":"https://github.com/mvdkleijn","followers_url":"https://api.github.com/users/mvdkleijn/followers","following_url":"https://api.github.com/users/mvdkleijn/following{/other_user}","gists_url":"https://api.github.com/users/mvdkleijn/gists{/gist_id}","starred_url":"https://api.github.com/users/mvdkleijn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvdkleijn/subscriptions","organizations_url":"https://api.github.com/users/mvdkleijn/orgs","repos_url":"https://api.github.com/users/mvdkleijn/repos","events_url":"https://api.github.com/users/mvdkleijn/events{/privacy}","received_events_url":"https://api.github.com/users/mvdkleijn/received_events","type":"User","site_admin":false},"created_at":"2015-09-22T08:08:55Z","updated_at":"2015-09-22T08:08:55Z","body":"Host SSH keys can be bound to a domain name using an SSHFP dns record, which would probably  work in this scenario but I'm not sure how secure that would be. Also, you'd be using dns again..\r\n\r\nI would suggest this should not be supported.\r\n\r\nWe use Chef ourselves and I know of the possible timing issues with spinning up new machines. However, I would suggest that since letsencrypt /ACME is supposed to be an automated setup, it should not matter what certificate you get.\r\n\r\nSimply spin up the machine and install the automated client which runs on a restricted port not conflicting with other services. Or am I missing a scenario?"}}