Design: Let's Encrypt DNS challenge workflow #8268

Sub-issue of #7949.

When NethServer 8 runs behind a firewall or a reverse proxy that blocks the HTTP challenge, Let's Encrypt certificates can be obtained only with the DNS challenge: the server proves it controls the domain by writing a temporary record through the API of the DNS provider. This is already possible from the command line, but not from the UI. The DNS challenge also enables wildcard certificates, like *.example.org.

The DNS challenge is much slower than the current methods: the new record must reach every DNS server of the domain before Let's Encrypt can check it, which can take minutes. The time also grows with the number of names in the certificate, because each name needs its own record and check. The current request-and-wait workflow of the TLS certificates page may not fit.

Proposed solution

Design the cluster-admin workflow to:

• choose the challenge type (HTTP or DNS) in the TLS certificates page
• select the DNS provider from the supported list, and enter its credentials, which are stored safely and never shown again
• request a certificate, including wildcard names, without blocking the page while the DNS records spread, also when it lists many names: show the progress and notify the result when it arrives, even if the admin left the page
• explain the failures in plain words: wrong credentials, record not visible yet, rate limits
• decide how DNS challenge settings relate to the certificates of applications, which request their own host names. Still to decide: how to validate a certificate request started from an application page, usually the "Request Let's Encrypt certificate" switch in Settings. With the HTTP challenge the request is quick and the application waits for the result before saving its settings; with the DNS challenge the request may need to run in the background, so the application cannot know the result when its settings are saved

The design output is a mockup. Implementation issues follow.

Alternative solutions

• Keep the DNS challenge as a command-line configuration only.
• Accept manually uploaded certificates only: already possible, but certificates must be renewed by hand.

Additional context

Common scenario: on-premise NethVoice installations behind a customer firewall.

See also

• Traefik DNS-01 challenge UI: Traefik DNS-01 challenge UI #7949
• https://community.nethserver.org/t/ns8-dns-validation-for-lets-encrypt/22389
• https://community.nethserver.org/t/ns8-and-dns-01-wildcard-certificates/24817
• Traefik DNS providers: https://doc.traefik.io/traefik/https/acme/#providers