Hosted DNS signs one wildcard certificate per Cluster Domain from a CSR #1017

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

Hosted DNS signs one wildcard certificate per Cluster Domain from a CSR. POST /domains/{name}/certificate {csr} orders name + *.name from Google Trust Services using DNS-01 in its own zone and returns the PEM chain. The service never holds a private key or stores the certificate.

Acceptance criteria

• Only the token holder of name may call it; a CSR naming anything other than exactly name and *.name is refused.
• The service writes and removes _acme-challenge TXT records, waits for Route 53 to sync, finalises and returns the chain.
• One ACME account bound with Google Trust Services EAB from configuration; Retry-After on 429 is honoured.
• Tests exercise issuance end to end against a fake ACME CA that validates DNS-01 through the fake Route 53.

Blocked by

• Hosted DNS service: reserve, records, lease and release #1016