Automated Certificate Management Environment (ACME) DNS Labeled With …

[kxwzhang]

…ACME Account ID Challenge

https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/

• Implement ACME DNS Labeled With ACME Account ID Challenge (3.2.2.4.21) per draft-ietf-acme-dns-account-label:
  • request parameters with acme_account_url
  • DNS name prefix derivation via Acme
  • TXT lookup against key_authorization_hash
• Add the corresponding unit test coverage

request:

curl -sS -X POST 'http://localhost:8000/mpic-coordinator/mpic' \
  -H 'Content-Type: application/json' \
  -d '{
    "check_type": "dcv",
    "domain_or_ip_target": "f993bbef5d29ec8ae15b10a43e10812a.test.dcv-inspector.com",
    "orchestration_parameters": {
      "perspective_count": 2,
      "quorum_count": 2
    },
    "dcv_check_parameters": {
      "validation_method": "dns-account-01",
      "acme_account_url": "https://example.com/acme/acct/ExampleAccount",
      "key_authorization_hash": "test-key-authorization-hash"
    }
  }' | python3 -m json.tool

response:

{
    "mpic_completed": true,
    "request_orchestration_parameters": {
        "perspective_count": 2,
        "quorum_count": 2,
        "max_attempts": null,
        "cohort_for_single_attempt": null
    },
    "actual_orchestration_parameters": {
        "perspective_count": 2,
        "quorum_count": 2,
        "attempt_count": 1
    },
    "check_type": "dcv",
    "domain_or_ip_target": "f993bbef5d29ec8ae15b10a43e10812a.test.dcv-inspector.com",
    "is_valid": true,
    "trace_identifier": null,
    "perspectives": [
        {
            "perspective_code": "example-region-2",
            "check_response": {
                "check_completed": true,
                "check_passed": true,
                "errors": null,
                "timestamp_ns": 1780501197981318836,
                "check_type": "dcv",
                "details": {
                    "validation_method": "dns-account-01",
                    "records_seen": [
                        "test-key-authorization-hash"
                    ],
                    "response_code": 0,
                    "ad_flag": false,
                    "found_at": "_ujmmovf2vn55tgye._acme-challenge.f993bbef5d29ec8ae15b10a43e10812a.test.dcv-inspector.com",
                    "cname_chain": []
                }
            }
        },
        {
            "perspective_code": "example-region-1",
            "check_response": {
                "check_completed": true,
                "check_passed": true,
                "errors": null,
                "timestamp_ns": 1780501198042892877,
                "check_type": "dcv",
                "details": {
                    "validation_method": "dns-account-01",
                    "records_seen": [
                        "test-key-authorization-hash"
                    ],
                    "response_code": 0,
                    "ad_flag": false,
                    "found_at": "_ujmmovf2vn55tgye._acme-challenge.f993bbef5d29ec8ae15b10a43e10812a.test.dcv-inspector.com",
                    "cname_chain": []
                }
            }
        }
    ],
    "dcv_check_parameters": {
        "validation_method": "dns-account-01",
        "require_exact_case": true,
        "acme_account_url": "https://example.com/acme/acct/ExampleAccount",
        "key_authorization_hash": "test-key-authorization-hash",
        "dns_record_type": "TXT",
        "dns_name_prefix": "_ujmmovf2vn55tgye._acme-challenge"
    },
    "previous_attempt_results": null