Support for TNAuthlist identifier (#35)

* add support for TNAuthList identifier

* added notice

* added notice

* removed notice

---------

Co-authored-by: Pawan Tripathi <[email protected]>

Author: samuhvarta

acme/challenge.go

@@ -90,6 +90,12 @@ type Challenge struct {
 	// be included in the POST request. This field is applicable when responding
 	// to "device-attest-01" challenges.
 	Payload any `json:"-"`
+
+	// TkAuthType is the Authority Token Subtype as described in RFC9447 §3
+	// This field is only applicable when responding to "tkauth-01" challenges
+	// and indicates the type of Authority token that will be used
+	// to validate the challenge.
+	TkAuthType string `json:"tkauth-type,omitempty"`
 }
 
 // HTTP01ResourcePath returns the URI path for solving the http-01 challenge.
@@ -170,4 +176,5 @@ const (
 	ChallengeTypeTLSALPN01      = "tls-alpn-01"      // RFC 8737 §3
 	ChallengeTypeDeviceAttest01 = "device-attest-01" // draft-acme-device-attest-00 §5
 	ChallengeTypeEmailReply00   = "email-reply-00"   // RFC 8823 §5.2
+	ChallengeTypeAuthorityToken = "tkauth-01"        // RFC 9447 §3 - ACME Authority Token challenge type
 )

csr.go

@@ -20,6 +20,7 @@ import (
 	"crypto/rand"
 	"crypto/x509"
 	"encoding/asn1"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"net"
@@ -196,6 +197,7 @@ var (
 	oidExtensionSubjectAltName = []int{2, 5, 29, 17}
 	oidPermanentIdentifier     = []int{1, 3, 6, 1, 5, 5, 7, 8, 3}
 	oidHardwareModuleName      = []int{1, 3, 6, 1, 5, 5, 7, 8, 4}
+	oidExtensionTNAuthList     = []int{1, 3, 6, 1, 5, 5, 7, 1, 26} // TNAuthListIdentifier is defined in RFC9448
 )
 
 // RFC 5280 - https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.6
@@ -282,9 +284,16 @@ func createIdentifiersUsingCSR(csr *x509.CertificateRequest) ([]acme.Identifier,
 		})
 	}
 
-	// Extract permanent identifiers and hardware module values.
+	// Extract TNAuthList, permanent identifiers and hardware module values.
 	// This block will ignore errors.
 	for _, ext := range csr.Extensions {
+		// Extract TNAuthList Identifier
+		if ext.Id.Equal(oidExtensionTNAuthList) {
+			ids = append(ids, acme.Identifier{
+				Type:  "TNAuthList",
+				Value: base64.StdEncoding.EncodeToString(ext.Value),
+			})
+		}
 		if ext.Id.Equal(oidExtensionSubjectAltName) {
 			err := forEachSAN(ext.Value, func(tag int, data []byte) error {
 				var on otherName