How code the dns-persist-01 challenge

Caddy/CertMagic will probably have a CLI command (or admin API endpoint) you can invoke to get the value(s) needed for your dns-persist TXT records. It won't publish the record for you (for reasons already stated above; the point is not needing to provide DNS credentials).

We'll probably have users configure the ACME client to use the dns-persist challenge but let the ACME server do all the verifications.

I might experiment with trying to auto-detect dns-persist but I too worry that it will fall down at scale (be slow, not cover edge cases, etc).

My problem is that it's checking for the DNS TXT record rather than for the DNS persist TXT record.

I don't have the DNS TXT so it doesn't go any further.

getssl only supports the http-01 and dns-01 challenges. These are the most common so that is not surprising.

But, adding support for a third challenge dns-persist-01 will involve changing quite a few lines of code. If you want that supported long-term in getssl you'll need to provide that in a form the authors will be willing to include in the main build.

I apologize if I just misunderstand and you are an experienced coder. In that case, the reason Let's Encrypt is still validating using the dns-01 challenge is because you have not posted the URL for the dns-persist-01 challenge. The list of challenges appear in the authz object.

The ACME protocol is described in RFC 8555. See: RFC 8555 - Automatic Certificate Management Environment (ACME)

that's the info I needed; thanks