please support dns-persist-01 validation method

[christophvw]

https://datatracker.ietf.org/doc/html/draft-sheurich-acme-dns-persist-01

[glatzert]

Probably the same content, but it's the newer variant:
https://www.ietf.org/archive/id/draft-ietf-acme-dns-persist-00.html

Seems resonable to do - it needs a small extensions to allow or disallow challenge types directly via the options then I can implement it.

[glatzert]

@christophvw it's mostly done - I just need to add some configuration settings, that allow switching it off or on, since it's not "default" behaviour.
https://github.com/glatzert/ACME-Server-ADCS/releases/tag/V3.1.0-beta1

[christophvw]

Do you have any kind of documenation? How do I create an account?

And which client I should use for testing? Will you add support for this challenge in ACME-PS?

[glatzert]

Depending on your environment, I'd suggest certbot or wacs

Creating an account will be done through the client.
Documentation is available here: https://glatzert.github.io/ACME-Server-ADCS/docs-v3.1/prereqs.html
And here: https://github.com/glatzert/ACME-Server-ADCS/blob/releases/3.1/src/ACMEServer.ADCS/appsettings-sample.json

[glatzert]

Will you add support for this challenge in ACME-PS?

I think so - haven't done anything in ACME-PS for a while, but it's easy to add. Also I wanted to add profile support there as well...

[christophvw]

Looks like there is no client with dns-persist01 support yet and I have to wait...

[glatzert]

That's odd, since LE itself announced support for dns-persist-01 some weeks ago and they "own" certbot - or at least I thought so.

Edit: it seems planned for Q2 2026.
I'm not entirely sure, if I can make it, but I might be able to implement it during easter.
If you like to give it a shot yourself, the case would need to be handled here: https://github.com/PKISharp/ACME-PS/blob/master/ACME-PS/functions/Challenge/Initialize-Challenge.ps1

[glatzert]

ACME-PS can now handle most challenges (those where a payload is needed to fulfill the challenge are currently excluded).
Also the new beta has updated support for dns-persist-01 (a field was added to the challenge)

[christophvw]

Cannot get it to work yet..

I created a _validation-persist TXT record in DNS and used ACME-PS to create an account and to complete the challenge:

Doesn't it find the DNS record? Or does the validation fail? A bit more debug output would be helpful.

{"Timestamp":"2026-04-08T14:25:45.7119586\u002B02:00","EventId":0,"LogLevel":"Debug","Category":"Th11s.ACMEServer.Services.ChallengeValidation.DnsPersist01ChallengeValidator","Message":"Querying DNS for TXT records at ...
{"Timestamp":"2026-04-08T14:25:45.7132894\u002B02:00","EventId":3124,"LogLevel":"Information","Category":"Th11s.ACMEServer.Services.Processors.OrderValidationProcessor","Message":"Challenge ChallengeId { Value = e6es11ShqEaJeKemZsJy4Q } (dns-persist-01) was invalid.","State":{"ChallengeId":"ChallengeId { Value = e6es11ShqEaJeKemZsJy4Q }","ChallengeType":"dns-persist-01","{OriginalFormat}":"Challenge {ChallengeId} ({ChallengeType}) was invalid."},"Scopes":[]}

$order | Get-ACMEAuthorizationError -State $acmeStateDir;

Error : @{type=urn:ietf:params:acme:error:incorrectResponse; detail=Could not locate a valid _validation-persist TXT record.; identifier=}

[glatzert]

I'll add some logging messages to the debug channel about what has been parsed and discarded for what reason.

Do you have CAAIdentities set in the config?

[christophvw]

Do you have CAAIdentities set in the config?

Yes, without CAA config, dns-persist-01 is not offered at all.
But I failed to set a CAA record in DNS for the domain.

param(
    [string]$ZoneName = "example.com",
    [string]$RecordName = "@",
    [int]$Flags = 0,
    [string]$Tag = "issue",
    [string]$Value = "acme.example.com",
    [string]$DNSServer = "localhost",
    [int]$TTL = 3600
)

function Convert-ToCaaHex {
    param(
        [int]$Flags,
        [string]$Tag,
        [string]$Value
    )

    # Flag (1 Byte)
    $bytes = New-Object System.Collections.Generic.List[Byte]
    $bytes.Add([byte]$Flags)

    # Tag Länge + Tag
    $tagBytes = [System.Text.Encoding]::ASCII.GetBytes($Tag)
    $bytes.Add([byte]$tagBytes.Length)
    $bytes.AddRange($tagBytes)

    # Value
    $valueBytes = [System.Text.Encoding]::ASCII.GetBytes($Value)
    $bytes.AddRange($valueBytes)

    return ($bytes | ForEach-Object { $_.ToString("X2") }) -join ""
}

try {
    Import-Module DnsServer -ErrorAction Stop

    Write-Host "Erzeuge HEX-Daten für CAA Record..." -ForegroundColor Cyan
    $hexData = Convert-ToCaaHex -Flags $Flags -Tag $Tag -Value $Value

    Write-Host "HEX: $hexData"

    Write-Host "Erstelle CAA Record (TYPE 257)..." -ForegroundColor Cyan

    Add-DnsServerResourceRecord -ZoneName $ZoneName -Name $RecordName -Type 257 -RecordData $hexData -TimeToLive ([TimeSpan]::FromSeconds($TTL)) -ComputerName $DNSServer

    Write-Host "CAA Record erfolgreich erstellt!" -ForegroundColor Green
}
catch {
    Write-Error "Fehler: $_"
}

Fehler: Fehler beim Erstellen des Ressourcendatensatzes "@" in der Zone "example.com" auf dem Server "localhost".
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException

[glatzert]

https://github.com/glatzert/ACME-Server-ADCS/releases/tag/V3.1.0-beta8 has rather detailed Debug output for dns-persist-01 validation now.

[christophvw]

updated to beta8 and did the same as yesterday. now it seems to work...

Status : ready
Expires : 04/10/2026 14:31:52
NotBefore :
NotAfter :
Identifiers : {dns:test-123.example.org}

[glatzert]

Besides logging, i fixed a small oversight about CAAIdentities and casing - they are now compared case insensitive ...

Thanks for testing.