keychain-cli: NDNCERT dns-01 challenge

Author: yoursunny

pkg/keychain-cli/README.md

@@ -198,9 +198,9 @@ See `@ndn/ndnsec` package for more information.
 * `--dns-domain` specifies domain name to use in the DNS challenge.
 * You may specify multiple challenges, and the first one allowed by the server will be used.
 
-### NDNCERT examples
+### NDNCERT examples using NDNts CA
 
-CA setup with PIN challenge:
+CA setup with PIN & DNS & DNS-01 challenges:
 
 ```bash
 # generate CA key
@@ -212,9 +212,9 @@ NDNTS_KEYCHAIN=/tmp/ca-keychain ndnts-keychain ndncert03-make-profile --out /tmp
 # display CA profile
 ndnts-keychain ndncert03-show-profile --profile /tmp/ca.data
 
-# start CA with PIN challenge
+# start CA with three challenges
 nfd-start
-NDNTS_KEYCHAIN=/tmp/ca-keychain ndnts-keychain ndncert03-ca --profile /tmp/ca.data --store /tmp/ca-repo --challenge pin
+NDNTS_KEYCHAIN=/tmp/ca-keychain ndnts-keychain ndncert03-ca --profile /tmp/ca.data --store /tmp/ca-repo --challenge pin --challenge dns --challenge dns-01
 ```
 
 Client using PIN challenge, with NDNts keychain:
@@ -245,6 +245,20 @@ ndnts-keychain ndncert03-client --profile /tmp/ca.data --ndnsec --key $REQKEY --
 ndnsec list -c
 ```
 
+Client using DNS or DNS-01 challenge, with NDNts keychain:
+
+```bash
+# generate key pair
+REQCERT=$(NDNTS_KEYCHAIN=/tmp/req-keychain ndnts-keychain gen-key /B)
+REQKEY=$(echo $REQCERT | gawk 'BEGIN { FS=OFS="/" } { NF-=2; print }')
+
+# request certificate with DNS or DNS-01 challenge
+NDNTS_KEYCHAIN=/tmp/req-keychain ndnts-keychain ndncert03-client --profile /tmp/ca.data --key $REQKEY --challenge dns-01 --challenge dns --dns-domain example.net
+
+# view certificates
+NDNTS_KEYCHAIN=/tmp/req-keychain ndnts-keychain list-certs
+```
+
 Email challenge, NDNts keychain on client side:
 
 ```bash
@@ -302,6 +316,8 @@ ndnsec list -c
 ndnsec cert-dump -p -i /E
 ```
 
+### NDNCERT examples for global NDN testbed
+
 Email challenge with Ethereal Email, for global NDN testbed:
 
 ```bash
@@ -341,5 +357,5 @@ PROBE_EMAIL=$(openssl rand -hex 8)@ucla.edu
 
 # request certificate from the root CA
 ndnts-keychain ndncert03-client --profile /tmp/ndn-root-ca.client.conf --pp email $PROBE_EMAIL \
-  --challenge dns --dns-domain d.yoursunny.dev
+  --challenge dns --dns-domain example.net
 ```

pkg/keychain-cli/src/ndncert03-ca.ts

@@ -1,6 +1,6 @@
 import { exitClosers, openUplinks } from "@ndn/cli-common";
 import { createVerifier, SigningAlgorithmListFull } from "@ndn/keychain";
-import { Server, type ServerChallenge, ServerEmailChallenge, ServerNopChallenge, ServerPinChallenge, ServerPossessionChallenge } from "@ndn/ndncert";
+import { Server, type ServerChallenge, ServerDns01Challenge, ServerDnsChallenge, ServerEmailChallenge, ServerNopChallenge, ServerPinChallenge, ServerPossessionChallenge } from "@ndn/ndncert";
 import type { Verifier } from "@ndn/packet";
 import { makePersistentDataStore, PrefixRegShorter, RepoProducer } from "@ndn/repo";
 import { toHex } from "@ndn/util";
@@ -15,7 +15,8 @@ interface Args {
   profile: string;
   store: string;
   challenge: readonly string[];
-  possessionIssuer?: string;
+  "possession-issuer"?: string;
+  "doh-server": string;
 }
 
 export const Ndncert03CaCommand: CommandModule<{}, Args> = {
@@ -36,7 +37,7 @@ export const Ndncert03CaCommand: CommandModule<{}, Args> = {
       })
       .option("challenge", {
         array: true,
-        choices: ["nop", "pin", "email", "possession"],
+        choices: ["nop", "pin", "email", "possession", "dns", "dns-01"],
         demandOption: true,
         desc: "supported challenges",
         type: "string",
@@ -45,10 +46,15 @@ export const Ndncert03CaCommand: CommandModule<{}, Args> = {
         defaultDescription: "CA certificate",
         desc: "possession challenge - existing issuer certificate file",
         type: "string",
+      })
+      .option("doh-server", {
+        desc: "dns/dns-01 challenge - DNS over HTTPS server",
+        default: "https://cloudflare-dns.com/dns-query",
+        type: "string",
       });
   },
 
-  async handler({ profile: profileFile, store, challenge: challengeIds, possessionIssuer }) {
+  async handler({ profile: profileFile, store, challenge: challengeIds, "possession-issuer": possessionIssuer, "doh-server": dohServer }) {
     await openUplinks();
 
     const profile = await inputCaProfile(profileFile, true);
@@ -118,6 +124,14 @@ Otherwise, please disregard this message.`,
           challenges.push(new ServerPossessionChallenge(verifier));
           break;
         }
+        case "dns": {
+          challenges.push(new ServerDnsChallenge({ dohServer }));
+          break;
+        }
+        case "dns-01": {
+          challenges.push(new ServerDns01Challenge({ dohServer }));
+          break;
+        }
       }
     }
 

pkg/keychain-cli/src/ndncert03-client.ts

@@ -3,7 +3,7 @@ import fs from "node:fs/promises";
 import { openUplinks } from "@ndn/cli-common";
 import { CertNaming, generateSigningKey, type KeyChain, type NamedSigner, type NamedVerifier } from "@ndn/keychain";
 import { AltUri } from "@ndn/naming-convention2";
-import { type CaProfile, type ClientChallenge, type ClientChallengeContext, ClientDnsChallenge, ClientEmailChallenge, type ClientEmailInboxImap, ClientNopChallenge, ClientPinChallenge, type ClientPinLikeChallenge, ClientPossessionChallenge, matchProbe, requestCertificate, requestProbe } from "@ndn/ndncert";
+import { type CaProfile, type ClientChallenge, type ClientChallengeContext, ClientDns01Challenge, ClientDnsChallenge, ClientEmailChallenge, type ClientEmailInboxImap, ClientNopChallenge, ClientPinChallenge, type ClientPinLikeChallenge, ClientPossessionChallenge, matchProbe, requestCertificate, requestProbe } from "@ndn/ndncert";
 import { NdnsecKeyChain } from "@ndn/ndnsec";
 import { Name } from "@ndn/packet";
 import { console, toHex } from "@ndn/util";
@@ -51,7 +51,7 @@ export const Ndncert03ClientCommand: CommandModule<{}, Args> = {
       .option("challenge", {
         demandOption: true,
         array: true,
-        choices: ["nop", "pin", "email", "possession", "dns"],
+        choices: ["nop", "pin", "email", "possession", "dns", "dns-01"],
         desc: "supported challenges",
         type: "string",
       })
@@ -71,7 +71,7 @@ export const Ndncert03ClientCommand: CommandModule<{}, Args> = {
         type: "string",
       })
       .option("dns-domain", {
-        desc: "dns challenge - domain name",
+        desc: "dns/dns-01 challenge - domain name",
         type: "string",
       })
       .check(({ key }) => {
@@ -96,8 +96,8 @@ export const Ndncert03ClientCommand: CommandModule<{}, Args> = {
         return true;
       })
       .check(({ challenge, "dns-domain": domain }) => {
-        if (challenge.includes("dns") && !domain?.includes(".")) {
-          throw new Error("dns challenge enabled but --dns-domain is absent");
+        if ((challenge.includes("dns") || challenge.includes("dns-01")) && !domain?.includes(".")) {
+          throw new Error("dns/dns-01 challenge enabled but --dns-domain is absent");
         }
         return true;
       });
@@ -202,6 +202,10 @@ class InteractiveClient {
           challenges.push(new ClientDnsChallenge(this.args["dns-domain"]!, this.promptDns()));
           break;
         }
+        case "dns-01": {
+          challenges.push(new ClientDns01Challenge(this.args["dns-domain"]!, this.promptDns()));
+          break;
+        }
       }
     }
     return challenges;
@@ -232,17 +236,13 @@ class InteractiveClient {
   private promptDns(): ClientDnsChallenge.Prompt {
     return async (_context, recordName, expectedValue) => {
       console.log(`\nDNS record for certificate request\n${recordName}\tIN\tTXT\n${expectedValue}\n`);
-      while (true) {
-        const response = await prompts({
-          type: "confirm",
-          name: "ready",
-          message: "Confirm when DNS record is ready:",
-          initial: true,
-        });
-        if (response.ready) {
-          return;
-        }
-      }
+      await prompts({
+        type: "invisible",
+        name: "ready",
+        message: "Press ENTER when DNS record is ready:",
+      }, {
+        onCancel: () => { throw new Error("challenge aborted"); },
+      });
     };
   }
 }