Module dns 

The DNS-01 seam.

A certificate that covers both <zone> and *.<zone> needs two ACME authorizations — one per identifier — and RFC 8555 §8.4 puts both challenges’ answers at the same DNS name: _acme-challenge.<zone>. The two values must be published together and both must be visible when the CA checks, so this is not “publish, then overwrite” — it is “publish a set of values at one name, then withdraw all of them together.”

didbot_dns::DnsProvider’s publish_txt/withdraw_txt/txt_values are the multi-value API a challenge name needs: additive per value, and idempotent for a value already there.

This module does not fork a second DNS client to use them; instead AcmeDnsChallenge states exactly what ACME’s DNS-01 step needs — nothing more — and DnsProviderAdapter is the thin join: it diffs the value set a challenge asks for against what didbot_dns::DnsProvider::txt_values already has published at that name, and issues one publish_txt/withdraw_txt call per value that needs to change, so a retried publish for values already there is a no-op and a withdraw of a value someone else already cleared is not an error. Any DnsProvider — Route53Dns in production, InMemoryDns in a test — becomes an AcmeDnsChallenge this way with no new network code. InMemoryAcmeDns remains this crate’s own hand-rolled double, kept because it models the set-per-name bookkeeping independently of didbot-dns’s, which is what makes it useful as a check on DnsProviderAdapter rather than a copy of what it wraps. The same seam carries AcmeDnsChallenge::authorize_issuer, which is about the zone rather than about one order: the CAA record saying which authority, and which account at that authority, may issue for any name in it. It belongs here because both halves of that record — the authority and the account URI — are read off the very objects an order is placed through, and a CAA record that disagrees with them is an outage.

Structs

DnsProviderAdapter

Adapts any [didbot_dns::DnsProvider] into an AcmeDnsChallenge.

InMemoryAcmeDns

The in-memory double: what this crate’s own tests use, and a model for a production implementation’s bookkeeping.

IssuancePolicy

Who may issue certificates for a zone: one authority, one account at it, and where that authority should report a request it refused.

Enums

AcmeDnsError

Why a challenge value could not be published or withdrawn.

Traits

AcmeDnsChallenge

What ACME’s DNS-01 step needs from a DNS backend, and nothing more.

Functions

publish_error 🔒

withdraw_error 🔒