BUG/MEDIUM: acme: append dns-01 records instead of replacing them

A certificate covering both `example.com` and `*.example.com` gets two
dns-01 authorizations, each with its own token, but both use the same
record name: `_acme-challenge.example.com`.

`Present()` uses `SetRecords()`, which by libdns semantics replaces every
record with the same name and type. When the second challenge is
deployed, it deletes the TXT record of the first one, and one of the two
validations fails.

Use `AppendRecords()` when the provider implements
`libdns.RecordAppender`, and keep `SetRecords()` as a fallback. Cleanup
is unchanged: `DeleteRecords()` matches on name, type and value, so each
challenge only removes its own record.

Author: bilhackmac

acme/dns01.go

@@ -85,7 +85,16 @@ func (s *DNS01Solver) Present(ctx context.Context, domain, zone, keyAuth string)
 	// libdns expects record names relative to the zone.
 	rec.Name = libdns.RelativeName(rec.Name, zone)
 
-	results, err := s.provider.SetRecords(ctx, zone, []libdns.Record{rec})
+	// Append rather than Set: SetRecords replaces every record with the same
+	// name and type, which breaks certificates covering both a domain and its
+	// wildcard, since both challenges share the same _acme-challenge name.
+	var results []libdns.Record
+	var err error
+	if appender, ok := s.provider.(libdns.RecordAppender); ok {
+		results, err = appender.AppendRecords(ctx, zone, []libdns.Record{rec})
+	} else {
+		results, err = s.provider.SetRecords(ctx, zone, []libdns.Record{rec})
+	}
 	if err != nil {
 		return fmt.Errorf("adding temporary record for zone %q: %w", zone, err)
 	}