dns-account-01 challenge support

[ZeroClover]

Welcome

• Yes, I've searched for similar issues on GitHub and didn't find any.

How do you use lego?

Library

Effective version of lego

4.32.0

Detailed Description

https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/

Currently, the dns-01 challenge encounters issues in multi-cloud environments. If a single cloud service/CDN requires hosting the ACME challenge, it becomes difficult to issue certificates using the dns-01 challenge in other environments.

The dns-account-01 challenge has resolved this issue and has been approved by BR.

Google Trust Service has already adopted this challenge method in production.

[ldez]

The goal of dns-account-01 is to be able to run concurrently several clients, but there is a problem with the RFC.

One of the clients will create the TXT record, and the first one which will achieve the challenge will remove the record.

The client SHOULD de-provision the resource record(s) provisioned for this challenge once the challenge is complete, i.e., once the "status" field of the challenge has the value "valid" or "invalid".
https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-account-label/#section-3.3

But how to be sure that all clients get the certificates before removing the TXT record? (This is not possible)

If one of the clients is waiting for the propagation when the other one is removing the TXT record, the challenge will potentially fail.

dns-persist-01 seems to be a better solution to this problem.