[Acme] Proposal for http challenge: Lookup SRV records before A/AAAA records

[Michael Wyraz <[e-mail]>]

Hi,

as discussed before, acme/http-01 is difficult to implement if the
domain being validated does not resolve to the IP address of the machine
where the client runs on.

Common cases are:
- multiple physical servers behind a tcp balancer (A-Record resolves to
the load balancer, not to the server where the acme client runs on).
- geo based dns resolution (A-Record resolves to the "nearest" server
which is not necessarily to the server where the acme client runs on)
- A-Record resolves to a device that is not able to run the acme client
(hardware firewall, router, load balancer)

I've created a proposal for using SRV (with fallback to A/AAAA) to solve
these issues: https://github.com/ietf-wg-acme/acme/pull/83

As you can see, the change only affects a small part of the server side
of the protocol and should have minimal impact to implementations.

Let me know what you think about it.

Kind regards,
Michael.