v2.54.0 (tls-alpn-01 in the ACME server)
One feature for the ACME server.
- The ACME server checks tls-alpn-01 (#1339, RFC 8737). A client that can answer only on port 443, with port 80 closed or taken by something else, can now prove a name, or an IPv4 address, without write access to DNS: it serves a self-signed certificate for the ALPN protocol
acme-tls/1, and CertMate checks it on port 443 under the same guards and time limit as http-01. Every authorization but a wildcard's offers it, after the challenges offered before, so a client keeps finding the one it is configured for. An address is checked with its reverse name as SNI, as RFC 8738 requires. lego (--tls) and acme.sh (--alpn) prove a name and an address this way in the interoperability job. See the ACME server.
Under the hood: a failed TLS handshake during a check is reported as the ACME tls problem type, and a certificate a client shows that cannot be read makes its challenge invalid; the interoperability job gains four legs, each of which checks in the server's own record that tls-alpn-01 is the challenge that validated the identifier.
The API contract is unchanged (2.58).