Adding new entries to the JSON object returned by /directory causes a number of ACME clients to hard-fail when they do not support the new endpoint. Efforts to work around this have shown themselves to be an incomplete & cumbersome in practice.
We should take a page from TLS 1.3 and the "GREASE" (Generate Random Extensions And Sustain Extensibility) concept and randomly generate a /directory entry on every client request. This will ensure that ACME client authors inter-operating with Let's Encrypt will not treat unsupported directory entries as a hard failure.
We will have to feature flag gate this and make an announcement in the new API announcements category before we turn the feature on to ensure that client developers are prepared.
Adding new entries to the JSON object returned by
/directorycauses a number of ACME clients to hard-fail when they do not support the new endpoint. Efforts to work around this have shown themselves to be an incomplete & cumbersome in practice.We should take a page from TLS 1.3 and the "GREASE" (Generate Random Extensions And Sustain Extensibility) concept and randomly generate a
/directoryentry on every client request. This will ensure that ACME client authors inter-operating with Let's Encrypt will not treat unsupported directory entries as a hard failure.We will have to feature flag gate this and make an announcement in the new API announcements category before we turn the feature on to ensure that client developers are prepared.