Implement TLS-ALPN challenge method

[mithrandi]

The endpoint should be switched to use this method, too.

[mithrandi]

This is available in LE production: https://community.letsencrypt.org/t/tls-alpn-validation-method/63814

[glyph]

🙌

[mithrandi]

We need to get in here somehow, I guess: https://github.com/glyph/txsni/blob/fc638e8f2f793284eecce606dc0183e57128bbf5/txsni/snimap.py#L137

[dholth]

What if this was converted to twisted? Then certificate requests could be delegated to dehydrated (a letsencrypt client written in bash). I don't know how to convert this to twisted or add listeners for certain next-protocols. https://github.com/lukas2511/dehydrated/blob/master/docs/tls-alpn.md#example-responder

[dholth]

Looks pretty straightforward to me. The magic word is acceptableProtocols. Here's where h2 support is added. https://github.com/twisted/twisted/blob/trunk/src/twisted/web/server.py#L856

Here's where the next protocol speaks https://github.com/twisted/twisted/blob/trunk/src/twisted/web/http.py#L2885

tls-alpn isn't supposed to speak or listen, so it might work without changing that. It should close the connection right after it sends the certificate. Unfortunately IIUC there isn't a callback for 'negotiation done but no data received yet'.

All you'd have to do is add tls-alpn to the end of acceptableProtocols, have a second HostDirectoryMap for an alpn/ directory, and send a different cert if tls-alpn.

    def selectContext(self, connection):
        oldContext = connection.get_context()
        newContext = self.mapping[connection.get_servername()].getContext()

        negotiationData = self._negotiationDataForContext[oldContext]
        negotiationData.negotiateNPN(newContext)
        negotiationData.negotiateALPN(newContext)

        # new code
        if tls-alpn: newContext = self.alpn_mapping[connection.get_servername()].getContext()

        connection.set_context(newContext)

Could prototype with an existing alpn client and then implement the entire flow in Python.

[dholth]

This is difficult. It looks like the alpn callback fires after selectContext() return even though dehydrated's version seems to manage right after the SNI servername is given.
I was trying to go through txsni to have it provide certificates from a second directory if tls-alpn, having a hard time understanding how or if available next protocols propagate to the switched context.
It might be normal to provide the default certificate with accepted ALPN set, and switch contexts twice during negotation if acme.

[dholth]

glyph/txsni#26 sends the alpn / acme certificate if it exists