Add dns-persist-01 to the ACME provisioner commands

[joshdrake]

Name of feature:

step ca provisioner add/update support for the ACME dns-persist-01 challenge
(draft-ietf-acme-dns-persist-02).

• --challenge accepts dns-persist-01, and so does --remove-challenge on update.
• New ACME flags, which map to the step-ca provisioner properties issuerDomainNames and accountHashPrefix:
  • --issuer-domain-name (repeatable): the issuer names that _validation-persist TXT records must name.
  • --remove-issuer-domain-name (repeatable, update only).
  • --account-hash-prefix: the URL prefix of the hashed account URIs.
• The --challenge help text documents dns-persist-01, and the help for both commands has an example.

step ca provisioner add acme --type ACME --challenge dns-persist-01 \
  --issuer-domain-name ca.example.com \
  --account-hash-prefix https://ca.example.com/acme/acme/account-hash/

The CLI doesn't validate these values itself. step-ca validates them when it loads the provisioner, for both
ca.json and remote management.

Pain or issue this feature alleviates:

The challenge can't be configured from the CLI today. Worse, step ca provisioner update converts a ca.json
provisioner to linkedca and back, which silently removes dns-persist-01 and its options. With step 0.31.0, an
unrelated change such as step ca provisioner update acme --x509-max-dur 24h does this. If dns-persist-01 was the
only challenge, the provisioner falls back to the default challenges.

Is there documentation on how to use this feature? If so, where?

The command help, as described above.

In what environments or workflows is this feature explicitly NOT supported (if any)?

Older step binaries still remove these settings when they update a provisioner, so users need this version.

Supporting links/other PRs/issues:

• Add the dns-persist-01 ACME challenge type linkedca#170 adds the challenge type and fields.
• Add the ACME dns-persist-01 challenge certificates#2826 adds the challenge to step-ca and the linkedca conversion.
• go.mod pins both branches as pseudo-versions; they must be bumped to releases before merging. The newer linkedca
  requires go 1.26.7, so the go directive moves up from 1.26.0. The certificates pseudo-version comes from
  certificates master, which also brings in that repo's newer indirect dependencies.

Testing

• Unit tests for flag validation, the linkedca challenge mapping, createACMEDetails, and updateACMEDetails
  (adding and removing names, and replacing or clearing the prefix).
• go test ./... and golangci-lint with the shared config: clean.
• Manual run against a ca.json-only CA with a step binary built from this branch:
  • add with dns-persist-01 writes the challenge and both properties.
  • An unrelated update --x509-max-dur 48h keeps them.
  • update --issuer-domain-name … --remove-issuer-domain-name … --account-hash-prefix … changes them.
  • add --challenge dns-persist-01 without the options fails with
    failed validating dns-persist-01 options: issuerDomainNames cannot be empty.
  • For comparison, the released step 0.31.0 drops dns-persist-01, issuerDomainNames and accountHashPrefix
    on the same unrelated update.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}