[Feature Request] To add automatic letsencrypt DNS-01 challenge just like caddy web server

[diyism]

The biggest selling point of caddy web server is the automatic letsencrypt DNS-01 challenge,
the configuration of Caddyfile is very simple:

{
    servers {
        protocols h3
    }
    acme_dns cloudflare <api token>
}

:443, mysite.com:443 {
  respond / "Hello, world!"
  
}

So I'm expecting this in fullmoon.

[pkulchenko]

I've definitely considered this, but it's likely that HTTP-01 challenge is implemented first (https://letsencrypt.org/docs/challenge-types/). Things are not going to be simple for a couple of reasons: (1) if you look at Caddy's implementation of the cert management, there is a lot of things that need to be handled (with some of them implemented by other libraries, which are not going to be available here), and (2) some of the crypto methods needed to generate certificate-signing-request, signing requests, and a couple of other things (well described here: https://github.com/alexpeattie/letsencrypt-fromscratch#d-option-2-completing-the-dns-01-challenge) need to be added to redbean to allow them to be used from fullmoon.

[diyism]

I found a lua repo that support http-01: https://github.com/fffonion/lua-resty-acme

[pkulchenko]

Yes, but it depends on lua-resty-openssl, which in turn depends on both Lua JIT/FFI (not supported in redbean) and openssl library (not available in redbean either, which is using MbedTLS). It's still useful to have, as it implements the actual packaging. request/response, and the challenge logic, but the underlying crypto methods it uses, still need to be implemented in redbean.

[pkulchenko]

Here is the list of openssl calls from ACME.pm that shows relevant OpenSSL function that may need to be implemented using MbedTLS:

capturex('openssl', ('genrsa', '-out', $_, KEY_SIZE));
capturex('openssl', ('rsa', '-text', '-in', $self->{domain}{account}, '-noout', '-modulus'));
capturex('openssl', ('rsa', '-in', $self->{domain}{account}, '-pubout')));
capturex('openssl', ('dgst', '-sha256', '-binary', '-sign', $self->{domain}{account}, $stf->filename))
capturex('openssl', ('req', '-new', '-outform', 'DER', '-key', $self->{domain}{key}, '-config', $oct->filename, '-out', $self->{req}{csr}));