Extended ACME Protocol with Time-Limited VC Tokens for Automated Organization Validation

The Public Key Infrastructure (PKI) plays an essential role in securing Internet communications by enabling Certificate Authorities (CAs) to issue TLS certificates to web servers. These certificates enable browsers to authenticate web servers, though their expiration can disrupt website availability. To mitigate the problem, the Automated Certificate Management Environment (ACME) protocol automates certificate issuance and domain certification. However, Organization Validation (OV) certificate management is not automated because organization validation involves validating an organization’s legal status and intent that are manually conducted, and are challenging to automate. This paper proposes an extended ACME protocol using Verifiable Credentials (VCs) to automate organization validation. VCs are digitally signed credentials issued by trusted authorities containing verifiable information, such as identity or educational qualifications. Reusing a previously issued VC for organization validation can pose significant risks by potentially enabling malicious actors to bypass the validation process. The proposed protocol solves this challenge by forcing a client requesting an OV certificate to obtain a short-lived VC after initiating the organization validation process, thereby limiting the reuse of VC and preventing unauthorized use. Our experimental results demonstrate that this protocol enhances security by preventing misuse of invalid VC while minimizing delays in certificate issuance.