Add support for the dns-persist-01 challenge type

[beautifulentropy]

IETF Tracker: https://datatracker.ietf.org/doc/draft-sheth-identifiers-dns
GitHub: https://github.com/ietf-wg-acme/draft-ietf-acme-dns-persist/blob/main/draft-ietf-acme-dns-persist.md

[beautifulentropy]

This implementation is currently in development.

[kanashimia]

Hello @beautifulentropy, if it helps in any way I just implemented a client here for HAProxy:
https://github.com/kanashimia/haproxy/tree/acme-dns-persist-01

It is still WIP but may be barely useful for testing against it? Waiting on at least pebble support before actually merging that into the main haproxy repo.
I verified that it works against one other basic CA implementation.
Actually probably not that useful but still sharing.
I will do testing against your feature branch anyways when it is ready.

Basic instructions on how to get started with that

git clone https://github.com/kanashimia/haproxy.git --single-branch --branch acme-dns-persist-01 --depth 1
cd haproxy
nix develop nixpkgs#haproxy
make TARGET=linux-glibc USE_OPENSSL=1 -j8
# at this step copy config from below, modify it as needed, etc
./haproxy -f haproxy.cfg

This is an instruction for nix, but otherwise may need to install dependencies yourself instead of using nix develop.

Config file:

global
  expose-experimental-directives
  httpclient.resolvers.prefer ipv4
  httpclient.ssl.ca-file /path/to/pebble.minica.pem
  log stderr format short daemon

# verify that it works like this:
# curl -sSL https://localhost:3000 -v --cacert /path/to/pebble.minica.pem

defaults
  log global
  mode http
  option httplog
  option dontlognull
  timeout connect 1m
  timeout client  1m
  timeout server  1m

acme cool-ca
  account-key /path/to/account.key # if not specified it is created automatically
  directory http://localhost:8444/directory # can replace this 
  challenge dns-persist-01
  keytype ECDSA
  curves P-256
  # reuse-key on

listen ca-proxy
  mode http
  bind :8444
  option forwardfor
  server srv1 localhost:8080 alpn http/1.1
  # ^ just proxies communication
  # I did it like that so it is possible to run `mitmweb --mode reverse:http://localhost:8443`
  # So it is haproxy -> mitmproxy -> ca
  # also doing it like that adds some extra logging in haproxy
  # but you may want to remove that

crt-store cert
  load crt "localhost.pem" acme "cool-ca" domains "localhost,*.localhost"

frontend test
  bind :3000 ssl
  ssl-f-use crt "@cert/localhost.pem"
  http-request redirect scheme https code 301 if !{ ssl_fc } # redirect to https
  http-request return status 200 content-type "text/plain" lf-string "Ole Korrekt" 

In my setup I also used mitmproxy for debugging purposes, but you may choose not to.

Their docs are here: https://docs.haproxy.org/dev/configuration.html#12.8

(note that haproxy doesn't setup DNS records for you, nor does it persist certificates to disk by itself, it is something that is done with external tools)

[webprofusion-chrisc]

We will be releasing support for dns-persist-01 in https://certifytheweb.com (Certify Certificate Manager 7.x and Certify Management Hub).

Is there example config to enable this challenge type in pebble?

[Edit: got it working! I just had outdated pebble docker images and need to set command: -config test/config/pebble-config.json -strict in the docker compose yaml so it used a proper DNS resolver]