Add the ACME dns-persist-01 challenge

CHANGELOG.md

@@ -31,6 +31,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 - Support for ML-DSA (FIPS 204) keys, available when built with Go 1.27 or
   newer. JOSE-based flows (JWK, JWS and JWT tokens) do not support ML-DSA yet.
+- Support for the ACME `dns-persist-01` challenge defined in
+  [draft-ietf-acme-dns-persist-02](https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist-02).
+  It is disabled by default. To enable it, add `dns-persist-01` to the
+  `challenges` of an ACME provisioner and set its new `issuerDomainNames` and
+  `accountHashPrefix` properties.
 
 ### Changed
 

acme/api/account_test.go

@@ -51,6 +51,8 @@ func (*fakeProvisioner) IsAttestationFormatEnabled(context.Context, provisioner.
 	return true
 }
 func (*fakeProvisioner) GetAttestationRoots() (*x509.CertPool, bool)   { return nil, false }
+func (*fakeProvisioner) GetIssuerDomainNames() []string                { return nil }
+func (*fakeProvisioner) GetAccountHashPrefix() string                  { return "" }
 func (*fakeProvisioner) AuthorizeRevoke(context.Context, string) error { return nil }
 func (*fakeProvisioner) GetID() string                                 { return "" }
 func (*fakeProvisioner) GetName() string                               { return "" }

acme/api/handler.go

@@ -196,6 +196,8 @@ type Meta struct {
 	Website                 string   `json:"website,omitempty"`
 	CaaIdentities           []string `json:"caaIdentities,omitempty"`
 	ExternalAccountRequired bool     `json:"externalAccountRequired,omitempty"`
+	AccountHashPrefix       string   `json:"accountHashPrefix,omitempty"`
+	IssuerDomainNames       []string `json:"issuerDomainNames,omitempty"`
 }
 
 // Directory represents an ACME directory for configuring clients.
@@ -235,28 +237,35 @@ func GetDirectory(w http.ResponseWriter, r *http.Request) {
 		NewOrder:   linker.GetLink(ctx, acme.NewOrderLinkType),
 		RevokeCert: linker.GetLink(ctx, acme.RevokeCertLinkType),
 		KeyChange:  linker.GetLink(ctx, acme.KeyChangeLinkType),
-		Meta:       createMetaObject(acmeProv),
+		Meta:       createMetaObject(ctx, acmeProv),
 	})
 }
 
 // createMetaObject creates a Meta object if the ACME provisioner
 // has one or more properties that are written in the ACME directory output.
 // It returns nil if none of the properties are set.
-func createMetaObject(p *provisioner.ACME) *Meta {
-	if shouldAddMetaObject(p) {
-		return &Meta{
+func createMetaObject(ctx context.Context, p *provisioner.ACME) *Meta {
+	if shouldAddMetaObject(ctx, p) {
+		m := &Meta{
 			TermsOfService:          p.TermsOfService,
 			Website:                 p.Website,
 			CaaIdentities:           p.CaaIdentities,
 			ExternalAccountRequired: p.RequireEAB,
 		}
+		// The properties used to provision dns-persist-01 validation records
+		// are only advertised if the challenge is enabled.
+		if p.IsChallengeEnabled(ctx, provisioner.DNS_PERSIST_01) {
+			m.AccountHashPrefix = p.AccountHashPrefix
+			m.IssuerDomainNames = p.IssuerDomainNames
+		}
+		return m
 	}
 	return nil
 }
 
 // shouldAddMetaObject returns whether or not the ACME provisioner
 // has properties configured that must be added to the ACME directory object.
-func shouldAddMetaObject(p *provisioner.ACME) bool {
+func shouldAddMetaObject(ctx context.Context, p *provisioner.ACME) bool {
 	switch {
 	case p.TermsOfService != "":
 		return true
@@ -266,6 +275,8 @@ func shouldAddMetaObject(p *provisioner.ACME) bool {
 		return true
 	case p.RequireEAB:
 		return true
+	case p.IsChallengeEnabled(ctx, provisioner.DNS_PERSIST_01):
+		return true
 	default:
 		return false
 	}

acme/api/handler_test.go

@@ -837,27 +837,57 @@ func Test_createMetaObject(t *testing.T) {
 				ExternalAccountRequired: true,
 			},
 		},
+		{
+			name: "dns-persist-01",
+			p: &provisioner.ACME{
+				Type:              "ACME",
+				Name:              "acme",
+				Challenges:        []provisioner.ACMEChallenge{provisioner.DNS_PERSIST_01},
+				IssuerDomainNames: []string{"ca.local"},
+				AccountHashPrefix: "https://ca.local/acme/acme/account-hash/",
+			},
+			want: &Meta{
+				AccountHashPrefix: "https://ca.local/acme/acme/account-hash/",
+				IssuerDomainNames: []string{"ca.local"},
+			},
+		},
+		{
+			name: "dns-persist-01-disabled",
+			p: &provisioner.ACME{
+				Type:              "ACME",
+				Name:              "acme",
+				Challenges:        []provisioner.ACMEChallenge{provisioner.DNS_01},
+				IssuerDomainNames: []string{"ca.local"},
+				AccountHashPrefix: "https://ca.local/acme/acme/account-hash/",
+			},
+			want: nil,
+		},
 		{
 			name: "full-meta",
 			p: &provisioner.ACME{
-				Type:           "ACME",
-				Name:           "acme",
-				TermsOfService: "https://terms.ca.local",
-				Website:        "https://ca.local",
-				CaaIdentities:  []string{"ca.local", "ca.remote"},
-				RequireEAB:     true,
+				Type:              "ACME",
+				Name:              "acme",
+				TermsOfService:    "https://terms.ca.local",
+				Website:           "https://ca.local",
+				CaaIdentities:     []string{"ca.local", "ca.remote"},
+				RequireEAB:        true,
+				Challenges:        []provisioner.ACMEChallenge{provisioner.DNS_01, provisioner.DNS_PERSIST_01},
+				IssuerDomainNames: []string{"ca.local"},
+				AccountHashPrefix: "https://ca.local/acme/acme/account-hash/",
 			},
 			want: &Meta{
 				TermsOfService:          "https://terms.ca.local",
 				Website:                 "https://ca.local",
 				CaaIdentities:           []string{"ca.local", "ca.remote"},
 				ExternalAccountRequired: true,
+				AccountHashPrefix:       "https://ca.local/acme/acme/account-hash/",
+				IssuerDomainNames:       []string{"ca.local"},
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := createMetaObject(tt.p)
+			got := createMetaObject(context.Background(), tt.p)
 			if !cmp.Equal(tt.want, got) {
 				t.Errorf("createMetaObject() diff =\n%s", cmp.Diff(tt.want, got))
 			}

acme/api/order.go

@@ -378,6 +378,12 @@ func newAuthorization(ctx context.Context, az *acme.Authorization) error {
 			Status:    acme.StatusPending,
 			Target:    target,
 		}
+		// The dns-persist-01 challenge does not use a token, the validation
+		// record must contain one of the issuer domain names instead.
+		if typ == acme.DNSPERSIST01 {
+			ch.Token = ""
+			ch.IssuerDomainNames = prov.GetIssuerDomainNames()
+		}
 		if err := db.CreateChallenge(ctx, ch); err != nil {
 			return acme.WrapErrorISE(err, "error creating challenge")
 		}
@@ -506,6 +512,7 @@ func challengeTypes(az *acme.Authorization) []acme.ChallengeType {
 		if !az.Wildcard {
 			chTypes = append(chTypes, []acme.ChallengeType{acme.HTTP01, acme.TLSALPN01}...)
 		}
+		chTypes = append(chTypes, acme.DNSPERSIST01)
 	case acme.PermanentIdentifier:
 		chTypes = []acme.ChallengeType{acme.DEVICEATTEST01}
 	case acme.WireUser:

acme/api/order_test.go

@@ -588,6 +588,19 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
 			provisioner.WIREDPOP_01,
 		},
 	}
+	dnsPersistProvisioner := &provisioner.ACME{
+		Type: "ACME",
+		Name: "test@acme-<test>provisioner.com",
+		Challenges: []provisioner.ACMEChallenge{
+			provisioner.DNS_01,
+			provisioner.DNS_PERSIST_01,
+		},
+		IssuerDomainNames: []string{"ca.example.com", "ca.example.net"},
+		AccountHashPrefix: "https://ca.example.com/acme/account-hash/",
+	}
+	if err := dnsPersistProvisioner.Init(provisioner.Config{Claims: globalProvisionerClaims}); err != nil {
+		t.Fatal(err)
+	}
 	type test struct {
 		az   *acme.Authorization
 		prov acme.Provisioner
@@ -867,6 +880,106 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
 				az: az,
 			}
 		},
+		"ok/dns-persist-01": func(t *testing.T) test {
+			az := &acme.Authorization{
+				AccountID: "accID",
+				Identifier: acme.Identifier{
+					Type:  "dns",
+					Value: "zap.internal",
+				},
+				Status:    acme.StatusPending,
+				ExpiresAt: clock.Now(),
+			}
+			count := 0
+			var ch1, ch2 **acme.Challenge
+			return test{
+				prov: dnsPersistProvisioner,
+				db: &acme.MockDB{
+					MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error {
+						switch count {
+						case 0:
+							ch.ID = "dns"
+							assert.Equals(t, ch.Type, acme.DNS01)
+							assert.Equals(t, ch.Token, az.Token)
+							assert.Equals(t, len(ch.IssuerDomainNames), 0)
+							ch1 = &ch
+						case 1:
+							ch.ID = "dns-persist"
+							assert.Equals(t, ch.Type, acme.DNSPERSIST01)
+							assert.Equals(t, ch.Token, "")
+							assert.Equals(t, ch.IssuerDomainNames, []string{"ca.example.com", "ca.example.net"})
+							ch2 = &ch
+						default:
+							assert.FatalError(t, errors.New("test logic error"))
+							return errors.New("force")
+						}
+						count++
+						assert.Equals(t, ch.AccountID, az.AccountID)
+						assert.Equals(t, ch.Status, acme.StatusPending)
+						assert.Equals(t, ch.Value, "zap.internal")
+						return nil
+					},
+					MockCreateAuthorization: func(ctx context.Context, _az *acme.Authorization) error {
+						assert.Equals(t, _az.AccountID, az.AccountID)
+						assert.Equals(t, _az.Token, az.Token)
+						assert.Equals(t, _az.Status, acme.StatusPending)
+						assert.Equals(t, _az.Identifier, az.Identifier)
+						assert.Equals(t, _az.ExpiresAt, az.ExpiresAt)
+						assert.Equals(t, _az.Challenges, []*acme.Challenge{*ch1, *ch2})
+						assert.Equals(t, _az.Wildcard, false)
+						return nil
+					},
+				},
+				az: az,
+			}
+		},
+		"ok/dns-persist-01-wildcard": func(t *testing.T) test {
+			az := &acme.Authorization{
+				AccountID: "accID",
+				Identifier: acme.Identifier{
+					Type:  "dns",
+					Value: "*.zap.internal",
+				},
+				Status:    acme.StatusPending,
+				ExpiresAt: clock.Now(),
+			}
+			count := 0
+			var ch1, ch2 **acme.Challenge
+			return test{
+				prov: dnsPersistProvisioner,
+				db: &acme.MockDB{
+					MockCreateChallenge: func(ctx context.Context, ch *acme.Challenge) error {
+						switch count {
+						case 0:
+							ch.ID = "dns"
+							assert.Equals(t, ch.Type, acme.DNS01)
+							ch1 = &ch
+						case 1:
+							ch.ID = "dns-persist"
+							assert.Equals(t, ch.Type, acme.DNSPERSIST01)
+							assert.Equals(t, ch.IssuerDomainNames, []string{"ca.example.com", "ca.example.net"})
+							ch2 = &ch
+						default:
+							assert.FatalError(t, errors.New("test logic error"))
+							return errors.New("force")
+						}
+						count++
+						assert.Equals(t, ch.Value, "zap.internal")
+						return nil
+					},
+					MockCreateAuthorization: func(ctx context.Context, _az *acme.Authorization) error {
+						assert.Equals(t, _az.Identifier, acme.Identifier{
+							Type:  "dns",
+							Value: "zap.internal",
+						})
+						assert.Equals(t, _az.Challenges, []*acme.Challenge{*ch1, *ch2})
+						assert.Equals(t, _az.Wildcard, true)
+						return nil
+					},
+				},
+				az: az,
+			}
+		},
 		"ok/permanent-identifier-disabled": func(t *testing.T) test {
 			az := &acme.Authorization{
 				AccountID: "accID",
@@ -2688,7 +2801,7 @@ func TestHandler_challengeTypes(t *testing.T) {
 					Wildcard:   false,
 				},
 			},
-			want: []acme.ChallengeType{acme.DNS01, acme.HTTP01, acme.TLSALPN01},
+			want: []acme.ChallengeType{acme.DNS01, acme.HTTP01, acme.TLSALPN01, acme.DNSPERSIST01},
 		},
 		{
 			name: "ok/wildcard",
@@ -2698,7 +2811,7 @@ func TestHandler_challengeTypes(t *testing.T) {
 					Wildcard:   true,
 				},
 			},
-			want: []acme.ChallengeType{acme.DNS01},
+			want: []acme.ChallengeType{acme.DNS01, acme.DNSPERSIST01},
 		},
 		{
 			name: "ok/ip",