Dns-persist-01 challenge

[stewe]

@aarongable

Second, let's think through the workflow for setting up a dns-persist-01 record for the first time. The client operator configures their client to use this challenge. But they don't know what the CA's issuerDomainNames are, and they likely don't know their own ACME URL (it's stored in a config file... somewhere). So they can't just create the TXT record themselves. Instead, they tell the client to begin the issuance process, and it prompts them to create the record, printing out exactly what they should put in the text record and waiting for the user to confirm that they've done so. But how does it know that it needs to prompt and wait? If it did that every time, all renewals would be manual, and that's a problem. If it never did the prompt-and-wait, the user would never be told what record they should put in place. So the easy solution is for the client to check for the record itself, and only prompt if a matching record isn't found.

I had hoped the ACME client did not have to start the issuance process at all (by creating a new order) just to be able to get the CA's issuerDomainNames. (To get all needed values for the dns-persist-01 challenge)

Imagine for example using the "shortlived"-Profile where the "Pending Authorization Lifetime" is only 1 hour, so the DNS record has to be in place before the authz expires while prompt-and-wait. Otherwise the order is wasted and a new one has to be created later on when getting the certificate.

Even when a ACME client only wants to check wheter the correct dns record is present, it has to waste an order for that, assuming a stateless client with no caches.