Generate DNS-PERSIST-01 records for operator-managed pre-provisioning #1283

Parent: #1152

Problem

CA directory and DNS-PERSIST-01 discovery metadata are available through the interfaces after PR #1302, but do not constitute a ready-to-publish record. Raw account URLs are kept internal. Draft revision -02 uses a hashed URI; generation must obtain the account URL internally rather than require users to copy or supply it.

Implementation timing

Reviewed on 2026-10-21. Follow the staged scope in #1152. Defer this implementation until a target CA's staging environment supports the intended draft and usable interoperability examples or test vectors are available. Recheck the latest published specification and the CA's behavior before starting; the current baseline is draft -02.

At review time, the Let's Encrypt production and staging directories did not advertise issuerDomainNames or accountHashPrefix. The rollout announcement alone does not satisfy this gate. This is an Acmebot sequencing decision, not a claim that every scoped feature remains undefined in the draft.

Scope

• Generate the _validation-persist record name and TXT value from validated issuer metadata, account URL, current account public JWK thumbprint, and normalized provisioning domain.
• Implement the draft's exact SHA-256 byte construction and unpadded base64url encoding using accountHashPrefix, and verify the published test vectors. Bind the digest to the record's own normalized domain, not implicitly to a requested certificate SAN or a DNS-01 alias.
• Support explicit wildcard policy and optional persistUntil without silently broadening authorization scope. Treat the draft's domain-omitted hash opt-out as a separate explicit choice, with its privacy implications; do not confuse it with policy=wildcard.
• Generate records before opening an order; never create, update, or delete DNS records.
• Before releasing provisioning output for delegated publication, perform the required authenticated POST-as-GET account check against the exact account URL, without redirects, and require valid account status.
• Keep private keys out of output and logs. Reuse the existing public thumbprint helper where appropriate.

Acceptance criteria

• Generated output matches the selected draft's published test vectors.
• Domain normalization, wildcard base domains, expiry inputs, and invalid metadata are covered by tests.
• Pre-provisioning requires no order and no DNS provider credentials.
• Account verification uses an empty JWS payload, not an empty JSON object.

Specification baseline

https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist-02

Dependencies

#1282 (completed protocol/discovery foundation). The staging interoperability gate above remains outstanding.