feat(certbot): issue certificates via `dns-persist-01` - #1132

Open

kvinwang wants to merge 37 commits into

nextfrom

feat/certbot-dns-persist-01

Commits on Aug 26, 2026

feat(certbot): add the dns-persist-01 validation method
kvinwang
committed
a752055
feat(certbot): print the one-time dns-persist-01 records from the CLI
kvinwang
committed
72bbcae
feat(gateway): let a ZT domain validate with dns-persist-01
kvinwang
committed
b6834d4
docs: document dns-persist-01 certificate issuance
kvinwang
committed
c883548
docs: quote the real dns-persist-01 rejection from staging
kvinwang
committed
23f2fe3
fix(certbot): read a dns-persist-01 record the way the CA reads it
kvinwang
committed
8748630
fix(certbot): name the configured CA in dns-01 CAA records too
kvinwang
committed
108f500
fix(gateway): fit the dns-persist-01 dns wait inside the order timeout
kvinwang
committed
e49b1ba
feat(gateway): make the issuer domain name settable
kvinwang
committed
da71eb2
fix(gateway): keep a ZT domain's challenge across a dashboard edit
kvinwang
committed
45cd81b
docs: spell out the gateway dns-persist-01 setup order
kvinwang
committed
1ce6567
feat(gateway): register an ACME account before any ZT domain exists
kvinwang
committed
a2747b0
fix(certbot): check the configured issuer domain name before it reaches a zone
kvinwang
committed
3fb2a48
fix(certbot): keep the advisory DNS wait inside the order timeout
kvinwang
committed
0664f8f
fix(gateway): stop the dashboard hiding dns-persist-01 setup
kvinwang
committed
0e59643
docs: restore the issuer-name guidance and record the new rules
kvinwang
committed
db74dfa
fix(certbot): keep the account a failed client build would have dropped
kvinwang
committed
98f93d8
fix(certbot): stop the DNS wait overshooting the budget it was clamped to
kvinwang
committed
2c0ab2a
fix(certbot): hold the issuer domain name to the RFC 8659 label grammar
kvinwang
committed
a0ae4f9
fix(gateway): show the records dialog only where it applies
kvinwang
committed
fb85f27
fix(gateway): report a partial ACME rotation instead of raising it
kvinwang
committed
e82a578
fix(certbot): say which character an issuer name was rejected for
kvinwang
committed
1e9571f
refactor(certbot): log the DNS budget at debug, not on every issuance
kvinwang
committed
5c337e2
fix(certbot): name the character an issuer name was rejected for, not its first byte
kvinwang
committed
1ddcb3b
fix(gateway): count a rotation's re-pin failures out of the domains it tried
kvinwang
committed
1ed5644
fix(gateway): keep a partial rotation on the page instead of in a toast
kvinwang
committed
3a7f40c
fix(gateway): let an update leave a ZT domain's challenge alone
kvinwang
committed
8eb783f
fix(certbot): name the missing setting when dns-01 has no cf_api_token
kvinwang
committed
e31ebf6
fix(certbot): adopt stale CAA guards so a rerun can recover
kvinwang
committed
5ebd99a
test(certbot): hold every config key to its own doc comment
kvinwang
committed
4467792
test(gateway): cover dns-persist-01 up to the CA in the e2e suite
kvinwang
committed
4ec8980
test(gateway): issue a real dns-persist-01 certificate in the e2e suite
kvinwang
committed
63294d2
test: answer DNS over TCP in the mock, which is all Pebble asks
kvinwang
committed
102f896
test(gateway): validate the dns-persist-01 record against the CA, not around it
kvinwang
committed
9fa8421
test: keep one mock Cloudflare DNS API, in tools/
kvinwang
committed
94da8fd
test: let the mock's bind address be narrowed
kvinwang
committed
4c53736
test(gateway): pin what the CA refuses, not only what it accepts
kvinwang
committed
5ed087c