added ability to create multiple DNS TXT records per name

Author: larryboymi

README.md

@@ -1,4 +1,4 @@
-# Node Lambda ACME (Lets Encrypt-compatible)
+# Node Lambda ACME (Let's Encrypt-compatible)
 
 ![](https://sonarcloud.io/api/project_badges/measure?project=node-acme-lambda&metric=alert_status)
 

src/acme/authorize/getChallenges.js

@@ -7,7 +7,7 @@ const getDNSChallenge = (challenges) => challenges.find((challenge) => challenge
 const validateChallenges = (domain, accountKeyPair, challengeResponse) => {
   const dnsChallenge = getDNSChallenge(challengeResponse.challenges)
   return Promise.all([
-    updateDNSChallenge(domain, dnsChallenge, accountKeyPair)
+    updateDNSChallenge(domain, [dnsChallenge], accountKeyPair)
     .then(() => sendDNSChallengeValidation(dnsChallenge, accountKeyPair))
   ])
 }

src/acme/authorize/updateDNSChallenge.js

@@ -12,45 +12,51 @@ const retry = require('../../retry')(config['acme-dns-retry-delay-ms'], config['
 const getTokenDigest = (dnsChallenge, acctKeyPair) =>
   crypto.createHash('sha256').update(`${dnsChallenge.token}.${RSA.thumbprint(acctKeyPair)}`).digest()
 
-  const dnsPreCheck = (domain, expect) => (tryCount) => {
-    console.log(`Attempt ${tryCount + 1} to resolve TXT record for ${domain}`)
-    return resolveTxt(`_acme-challenge.${domain}`)
-    .then((data) => {
+const arrayContainsArray = (superset, subset) =>
+    subset.every(value => superset.indexOf(value) >= 0)
+
+const flatten = input => Array.prototype.concat.apply([], input)
+
+
+const dnsPreCheck = (domain, expect) => (tryCount) => {
+  console.log(`Attempt ${tryCount + 1} to resolve TXT record for ${domain}`)
+  return resolveTxt(`_acme-challenge.${domain}`)
+  .then(data => {
+    ++tryCount
+    return {
+      tryCount,
+      result: arrayContainsArray(flatten(data), expect)
+    }
+  })
+  .catch(e => {
+    if (e.code === 'ENODATA' || e.code === 'ENOTFOUND') {
       ++tryCount
-      return {
-        tryCount,
-        result: (data[0][0] === expect)
-      }
-    })
-    .catch((e) => {
-      if (e.code === 'ENODATA' || e.code === 'ENOTFOUND') {
-        ++tryCount
-        return { tryCount, result: false }
-      } else { throw e }
-    })
-  }
-
-  const validateDNSChallenge = (domain, dnsChallengeText) => {
-    return retry(0, dnsPreCheck(domain, dnsChallengeText))
-    .then((data) => {
-      if (data.result) {
-        return data.result
-      } else {
-        throw new Error(`Could not pre-validate DNS TXT record. Didn't find ${dnsChallengeText} in _acme-challenge.${domain}`)
-      }
-    })
-  }
-
-const updateDNSChallenge = (domain, dnsChallenge, acctKeyPair) => {
+      return { tryCount, result: false }
+    } else { throw e }
+  })
+}
+
+const validateDNSChallenge = (domain, dnsChallengeTexts) => {
+  return retry(0, dnsPreCheck(domain, dnsChallengeTexts))
+  .then((data) => {
+    if (data.result) {
+      return data.result
+    } else {
+      throw new Error(`Could not pre-validate DNS TXT record. Didn't find ${dnsChallengeTexts} in _acme-challenge.${domain}`)
+    }
+  })
+}
+
+const updateDNSChallenge = (domain, dnsChallenges, acctKeyPair) => {
   const domainName = (typeof domain === 'string') ? domain : domain.name
-  const dnsChallengeText = urlB64(getTokenDigest(dnsChallenge, acctKeyPair))
+  const dnsChallengeTexts = dnsChallenges.map(dnsChallenge => urlB64(getTokenDigest(dnsChallenge, acctKeyPair)))
   return getHostedZoneId(domain)
-  .then((id) => {
-    console.log(`Updating DNS TXT Record for ${domainName} to contain ${dnsChallengeText} in Route53 hosted zone ${id}`)
-    return updateTXTRecord(id, domainName, dnsChallengeText)
+  .then(id => {
+    console.log(`Updating DNS TXT Record for ${domainName} to contain ${dnsChallengeTexts} in Route53 hosted zone ${id}`)
+    return updateTXTRecord(id, domainName, dnsChallengeTexts)
   })
-  .then((updated) => validateDNSChallenge(domainName, dnsChallengeText))
-  .catch((e) => {
+  .then(updated => validateDNSChallenge(domainName, dnsChallengeTexts))
+  .catch(e => {
     console.error(`Couldn't write token digest to DNS record.`, e)
     throw e
   })

src/acme/generateCertificate.js

@@ -19,7 +19,7 @@ const v2ACME = (urls, certInfo) =>
   getAccount(newAccount(urls['newAccount'], urls['newNonce']))
   .then(account =>
     getV2Order(certInfo.domains, account.key, urls['newOrder'], urls['newNonce'], account.url)
-    .then(performAuthorizations(certInfo.domains, account.key, urls['newNonce'], account.url))
+    .then(performAuthorizations(account.key, urls['newNonce'], account.url))
     .then(createV2Certificate(certInfo, account.key, urls['newNonce'], account.url))
   )
 

src/acme/v2/performAuthorizations.js

@@ -5,21 +5,32 @@ const sendV2DNSChallengeValidation = require('./sendV2DNSChallengeValidation')
 
 const getDNSChallenge = (challenges) => challenges.find((challenge) => challenge.type === 'dns-01')
 
-const validateChallenges = (domain, accountKeyPair, challengeResponse, nonceUrl, url) => {
-  const dnsChallenge = getDNSChallenge(challengeResponse.challenges)
-  return Promise.all([
-    updateDNSChallenge(challengeResponse.identifier.value, dnsChallenge, accountKeyPair)
-    .then(() => sendV2DNSChallengeValidation(dnsChallenge, accountKeyPair, nonceUrl, url))
-  ])
-}
+const consolidateChallenges = authBodies =>
+  authBodies.reduce((acc, curr) => {
+    const dnsChallenge = getDNSChallenge(curr.challenges)
+    if (acc[curr.identifier.value]) {
+      acc[curr.identifier.value].push(dnsChallenge)
+    } else {
+      acc[curr.identifier.value] = [dnsChallenge]
+    }
+    return acc
+  }, {})
 
-module.exports = (domains, keypair, nonceUrl, url) => orderInfoUrl =>
+const validateChallenges = (accountKeyPair, nonceUrl, url) => challenges =>
+  Promise.all(Object.keys(challenges).map(txtName =>
+    updateDNSChallenge(txtName, challenges[txtName], accountKeyPair)
+    .then(() => sendV2DNSChallengeValidation(challenges[txtName], accountKeyPair, nonceUrl, url))
+  ))
+
+module.exports = (keypair, nonceUrl, url) => orderInfoUrl =>
   agent.get(orderInfoUrl)
   .then(({body}) =>
-    Promise.all(domains.map((domain, idx) =>
-      agent.get(body.authorizations[idx])
-      .then(({body: authBody}) => validateChallenges(domain, keypair, authBody, nonceUrl, url))
+    Promise.all(body.authorizations.map(authUrl =>
+      agent.get(authUrl)
+      .then(({body: authBody}) => authBody)
     ))
+    .then(consolidateChallenges)
+    .then(validateChallenges(keypair, nonceUrl, url))
     .then(() => body.finalize)
   )
   .catch((err) => {

src/acme/v2/sendV2DNSChallengeValidation.js

@@ -1,16 +1,16 @@
 const RSA = require('rsa-compat').RSA
 const sendSignedRequestV2 = require('./sendSignedRequestV2')
 
-const sendDNSChallengeValidation = (dnsChallenge, acctKeyPair, nonceUrl, url) => {
-  console.log(`Sending DNS challenge validation`)
-  return sendSignedRequestV2({
-    keyAuthorization: `${dnsChallenge.token}.${RSA.thumbprint(acctKeyPair)}`
-  }, acctKeyPair, dnsChallenge.url, nonceUrl, url)
-  .then(({body}) => body)
-  .catch((e) => {
-    console.error(`Couldn't send DNS challenge verification.`, e)
-    throw e
-  })
-}
+const sendDNSChallengeValidation = (dnsChallenges, acctKeyPair, nonceUrl, url) =>
+  Promise.all(dnsChallenges.map(dnsChallenge =>
+    sendSignedRequestV2({
+      keyAuthorization: `${dnsChallenge.token}.${RSA.thumbprint(acctKeyPair)}`
+    }, acctKeyPair, dnsChallenge.url, nonceUrl, url)
+    .then(({body}) => body)
+    .catch((e) => {
+      console.error(`Couldn't send DNS challenge verification.`, e)
+      throw e
+    })
+  ))
 
 module.exports = sendDNSChallengeValidation

src/aws/route53/updateTXTRecord.js

@@ -1,6 +1,6 @@
 const getRoute53 = require('../sdk/getRoute53')
 
-const updateTXTRecord = (hostedZoneId, domain, digest) => {
+const updateTXTRecord = (hostedZoneId, domain, digests) => {
   const toSend = {
     ChangeBatch: {
       Changes: [
@@ -9,7 +9,7 @@ const updateTXTRecord = (hostedZoneId, domain, digest) => {
           ResourceRecordSet: {
             Name: `_acme-challenge.${domain}`,
             Type: 'TXT',
-            ResourceRecords: [ { Value: JSON.stringify(digest) } ],
+            ResourceRecords: digests.map(digest => ({Value: JSON.stringify(digest)})),
             TTL: 1
           }
         }