WIP properly fails dry challenge

app.js

@@ -1,3 +1,4 @@
+/*global Promise*/
 (function () {
   'use strict';
 
@@ -47,8 +48,8 @@
       $$('button').map(function ($el) { $el.disabled = true; });
       var opts = {
         kty: $('input[name="kty"]:checked').value
-        , namedCurve: $('input[name="ec-crv"]:checked').value
+      , namedCurve: $('input[name="ec-crv"]:checked').value
-        , modulusLength: $('input[name="rsa-len"]:checked').value
+      , modulusLength: $('input[name="rsa-len"]:checked').value
       };
       console.log('opts', opts);
       Keypairs.generate(opts).then(function (results) {
@@ -112,15 +113,57 @@
       });
       acme.init('https://acme-staging-v02.api.letsencrypt.org/directory').then(function (result) {
         console.log('acme result', result);
+        var privJwk = JSON.parse($('.js-jwk').innerText).private;
+        var email = $('.js-email').innerText;
+        function checkTos(tos) {
+          console.log("TODO checkbox for agree to terms");
+          return tos;
+        }
         return acme.accounts.create({
-          email: $('.js-email').innerText
+          email: email
-        , agreeToTerms: function (tos) {
+        , agreeToTerms: checkTos
-            console.log("TODO checkbox for agree to terms");
+        , accountKeypair: { privateKeyJwk: privJwk }
-            return tos;
+        }).then(function (account) {
-          }
+          console.log("account created result:", account);
-        , accountKeypair: {
+          return Keypairs.generate({
-            privateKeyJwk: JSON.parse($('.js-jwk').innerText).private
+            kty: 'RSA'
-          }
+          , modulusLength: 2048
+          }).then(function (pair) {
+            console.log('domain keypair:', pair);
+            var domains = ($('.js-domains').innerText||'example.com').split(/[, ]+/g);
+            return acme.certificates.create({
+              accountKeypair: { privateKeyJwk: privJwk }
+            , account: account
+            , domainKeypair: { privateKeyJwk: pair.private }
+            , email: email
+            , domains: domains
+            , agreeToTerms: checkTos
+            , challenges: {
+                'dns-01': {
+                  set: function (opts) {
+                    console.log('dns-01 set challenge:');
+                    console.log(JSON.stringify(opts, null, 2));
+                    return new Promise(function (resolve) {
+                      while (!window.confirm("Did you set the challenge?")) {}
+                      resolve();
+                    });
+                  }
+                , remove: function (opts) {
+                    console.log('dns-01 remove challenge:');
+                    console.log(JSON.stringify(opts, null, 2));
+                    return new Promise(function (resolve) {
+                      while (!window.confirm("Did you delete the challenge?")) {}
+                      resolve();
+                    });
+                  }
+                }
+              }
+            });
+          });
+        }).catch(function (err) {
+          console.error("A bad thing happened:");
+          console.error(err);
+          window.alert(err.message || JSON.stringify(err, null, 2));
         });
       });
     });

index.html

@@ -63,6 +63,10 @@
     <form class="js-acme-account">
       <label for="-acmeEmail">Email:</label>
       <input class="js-email" type="email" id="-acmeEmail">
+      <br>
+      <label for="-acmeDomains">Domains:</label>
+      <input class="js-domains" type="text" id="-acmeDomains">
+      <br>
       <button class="js-create-account" hidden>Create Account</button>
     </form>
 

lib/acme.js

@@ -7,7 +7,7 @@
 /* globals Promise */
 
 var ACME = exports.ACME = {};
-var Keypairs = exports.Keypairs || {};
+//var Keypairs = exports.Keypairs || {};
 var Enc = exports.Enc || {};
 var Crypto = exports.Crypto || {};
 
@@ -90,7 +90,7 @@ ACME._getNonce = function (me) {
       break;
     }
   }
-  if (nonce) { return Promise.resolve(nonce); }
+  if (nonce) { return Promise.resolve(nonce.nonce); }
   return me.request({ method: 'HEAD', url: me._directoryUrls.newNonce }).then(function (resp) {
     return resp.headers['replay-nonce'];
   });
@@ -132,26 +132,7 @@ ACME._registerAccount = function (me, options) {
         return;
       }
 
-      var jwk = options.accountKeypair.privateKeyJwk;
+      return ACME._importKeypair(me, options.accountKeypair).then(function (pair) {
-      var p;
-      if (jwk) {
-        // nix the browser jwk extras
-        jwk.key_ops = undefined;
-        jwk.ext = undefined;
-        p = Promise.resolve({ private: jwk, public: Keypairs.neuter({ jwk: jwk }) });
-      } else {
-        p = Keypairs.import({ pem: options.accountKeypair.privateKeyPem });
-      }
-      return p.then(function (pair) {
-        options.accountKeypair.privateKeyJwk = pair.private;
-        options.accountKeypair.publicKeyJwk = pair.public;
-        if (pair.public.kid) {
-          pair = JSON.parse(JSON.stringify(pair));
-          delete pair.public.kid;
-          delete pair.private.kid;
-        }
-        return pair;
-      }).then(function (pair) {
         var contact;
         if (options.contact) {
           contact = options.contact.slice(0);
@@ -209,7 +190,7 @@ ACME._registerAccount = function (me, options) {
               status: 'valid'
             }
             */
-            if (!account) { account = { _emptyResponse: true, key: {} }; }
+            if (!account) { account = { _emptyResponse: true }; }
             // https://git.coolaj86.com/coolaj86/acme-v2.js/issues/8
             if (!account.key) { account.key = {}; }
             account.key.kid = options._kid;
@@ -346,9 +327,10 @@ ACME._testChallenges = function (me, options) {
       , wildcard: identifierValue.includes('*.') || undefined
       };
       var dryrun = true;
-      var auth = ACME._challengeToAuth(me, options, results, challenge, dryrun);
+      return ACME._challengeToAuth(me, options, results, challenge, dryrun).then(function (auth) {
-      return ACME._setChallenge(me, options, auth).then(function () {
+        return ACME._setChallenge(me, options, auth).then(function () {
-        return auth;
+          return auth;
+        });
       });
     });
   })).then(function (auths) {
@@ -402,17 +384,19 @@ ACME._challengeToAuth = function (me, options, request, challenge, dryrun) {
   auth.hostname = auth.identifier.value;
   // because I'm not 100% clear if the wildcard identifier does or doesn't have the leading *. in all cases
   auth.altname = ACME._untame(auth.identifier.value, auth.wildcard);
-  return me.Keypairs.thumbprint({ jwk: options.accountKeypair.publicKeyJwk }).then(function (thumb) {
+  return ACME._importKeypair(me, options.accountKeypair).then(function (pair) {
-    auth.thumbprint = thumb;
+    return me.Keypairs.thumbprint({ jwk: pair.public }).then(function (thumb) {
-    //   keyAuthorization = token || '.' || base64url(JWK_Thumbprint(accountKey))
+      auth.thumbprint = thumb;
-    auth.keyAuthorization = challenge.token + '.' + auth.thumbprint;
+      //   keyAuthorization = token || '.' || base64url(JWK_Thumbprint(accountKey))
-    // conflicts with ACME challenge id url is already in use, so we call this challengeUrl instead
+      auth.keyAuthorization = challenge.token + '.' + auth.thumbprint;
-    auth.challengeUrl = 'http://' + auth.identifier.value + ACME.challengePrefixes['http-01'] + '/' + auth.token;
+      // conflicts with ACME challenge id url is already in use, so we call this challengeUrl instead
-    auth.dnsHost = dnsPrefix + '.' + auth.hostname.replace('*.', '');
+      auth.challengeUrl = 'http://' + auth.identifier.value + ACME.challengePrefixes['http-01'] + '/' + auth.token;
+      auth.dnsHost = dnsPrefix + '.' + auth.hostname.replace('*.', '');
 
-    return Crypto._sha('sha256', auth.keyAuthorization).then(function (hash) {
+      return Crypto._sha('sha256', auth.keyAuthorization).then(function (hash) {
-      auth.dnsAuthorization = hash;
+        auth.dnsAuthorization = hash;
-      return auth;
+        return auth;
+      });
     });
   });
 };
@@ -542,15 +526,20 @@ ACME._postChallenge = function (me, options, auth) {
   return respondToChallenge();
 };
 ACME._setChallenge = function (me, options, auth) {
+  console.log('challenge auth:', auth);
+  console.log('challenges:', options.challenges);
   return new Promise(function (resolve, reject) {
+    var challengers = options.challenges || {};
+    var challenger = (challengers[auth.type] && challengers[auth.type].set) || options.setChallenge;
     try {
-      if (1 === options.setChallenge.length) {
+      if (1 === challenger.length) {
-        options.setChallenge(auth).then(resolve).catch(reject);
+        challenger(auth).then(resolve).catch(reject);
-      } else if (2 === options.setChallenge.length) {
+      } else if (2 === challenger.length) {
-        options.setChallenge(auth, function (err) {
+        challenger(auth, function (err) {
           if(err) { reject(err); } else { resolve(); }
         });
       } else {
+        // TODO remove this old backwards-compat
         var challengeCb = function(err) {
           if(err) { reject(err); } else { resolve(); }
         };
@@ -563,7 +552,7 @@ ACME._setChallenge = function (me, options, auth) {
           console.warn("The API has been changed for compatibility with all ACME / Let's Encrypt challenge types.");
           ACME._setChallengeWarn = true;
         }
-        options.setChallenge(auth.identifier.value, auth.token, auth.keyAuthorization, challengeCb);
+        challenger(auth.identifier.value, auth.token, auth.keyAuthorization, challengeCb);
       }
     } catch(e) {
       reject(e);
@@ -577,81 +566,82 @@ ACME._setChallenge = function (me, options, auth) {
 };
 ACME._finalizeOrder = function (me, options, validatedDomains) {
   if (me.debug) { console.debug('finalizeOrder:'); }
-  var csr = me.Keypairs.generateCsrWeb64(options.domainKeypair, validatedDomains);
+  return ACME._generateCsrWeb64(me, options, validatedDomains).then(function (csr) {
-  var body = { csr: csr };
+    var body = { csr: csr };
-  var payload = JSON.stringify(body);
+    var payload = JSON.stringify(body);
 
-  function pollCert() {
+    function pollCert() {
-    if (me.debug) { console.debug('[acme-v2.js] pollCert:'); }
+      if (me.debug) { console.debug('[acme-v2.js] pollCert:'); }
-    return ACME._jwsRequest({
+      return ACME._jwsRequest({
-      options: options
+        options: options
-    , url: options._finalize
+      , url: options._finalize
-    , protected: { kid: options._kid }
+      , protected: { kid: options._kid }
-    , payload: Enc.strToBuf(payload)
+      , payload: Enc.strToBuf(payload)
-    }).then(function (resp) {
+      }).then(function (resp) {
-      if (me.debug) { console.debug('order finalized: resp.body:'); }
+        if (me.debug) { console.debug('order finalized: resp.body:'); }
-      if (me.debug) { console.debug(resp.body); }
+        if (me.debug) { console.debug(resp.body); }
 
-      // https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.1.3
+        // https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-7.1.3
-      // Possible values are: "pending" => ("invalid" || "ready") => "processing" => "valid"
+        // Possible values are: "pending" => ("invalid" || "ready") => "processing" => "valid"
-      if ('valid' === resp.body.status) {
+        if ('valid' === resp.body.status) {
-        options._expires = resp.body.expires;
+          options._expires = resp.body.expires;
-        options._certificate = resp.body.certificate;
+          options._certificate = resp.body.certificate;
 
-        return resp.body; // return order
+          return resp.body; // return order
-      }
+        }
 
-      if ('processing' === resp.body.status) {
+        if ('processing' === resp.body.status) {
-        return ACME._wait().then(pollCert);
+          return ACME._wait().then(pollCert);
-      }
+        }
 
-      if (me.debug) { console.debug("Error: bad status:\n" + JSON.stringify(resp.body, null, 2)); }
+        if (me.debug) { console.debug("Error: bad status:\n" + JSON.stringify(resp.body, null, 2)); }
+
+        if ('pending' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'pending'."
+          + " Best guess: You have not accepted at least one challenge for each domain:\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2)
+          ));
+        }
+
+        if ('invalid' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'invalid'."
+          + " Best guess: One or more of the domain challenges could not be verified"
+          + " (or the order was canceled).\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2)
+          ));
+        }
+
+        if ('ready' === resp.body.status) {
+          return Promise.reject(new Error(
+            "Did not finalize order: status 'ready'."
+          + " Hmmm... this state shouldn't be possible here. That was the last state."
+          + " This one should at least be 'processing'.\n"
+          + "Requested: '" + options.domains.join(', ') + "'\n"
+          + "Validated: '" + validatedDomains.join(', ') + "'\n"
+          + JSON.stringify(resp.body, null, 2) + "\n\n"
+          + "Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js"
+          ));
+        }
 
-      if ('pending' === resp.body.status) {
         return Promise.reject(new Error(
-          "Did not finalize order: status 'pending'."
+          "Didn't finalize order: Unhandled status '" + resp.body.status + "'."
-        + " Best guess: You have not accepted at least one challenge for each domain:\n"
+        + " This is not one of the known statuses...\n"
-        + "Requested: '" + options.domains.join(', ') + "'\n"
-        + "Validated: '" + validatedDomains.join(', ') + "'\n"
-        + JSON.stringify(resp.body, null, 2)
-        ));
-      }
-
-      if ('invalid' === resp.body.status) {
-        return Promise.reject(new Error(
-          "Did not finalize order: status 'invalid'."
-        + " Best guess: One or more of the domain challenges could not be verified"
-        + " (or the order was canceled).\n"
-        + "Requested: '" + options.domains.join(', ') + "'\n"
-        + "Validated: '" + validatedDomains.join(', ') + "'\n"
-        + JSON.stringify(resp.body, null, 2)
-        ));
-      }
-
-      if ('ready' === resp.body.status) {
-        return Promise.reject(new Error(
-          "Did not finalize order: status 'ready'."
-        + " Hmmm... this state shouldn't be possible here. That was the last state."
-        + " This one should at least be 'processing'.\n"
         + "Requested: '" + options.domains.join(', ') + "'\n"
         + "Validated: '" + validatedDomains.join(', ') + "'\n"
         + JSON.stringify(resp.body, null, 2) + "\n\n"
         + "Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js"
         ));
-      }
+      });
+    }
 
-      return Promise.reject(new Error(
+    return pollCert();
-        "Didn't finalize order: Unhandled status '" + resp.body.status + "'."
+  });
-      + " This is not one of the known statuses...\n"
-      + "Requested: '" + options.domains.join(', ') + "'\n"
-      + "Validated: '" + validatedDomains.join(', ') + "'\n"
-      + JSON.stringify(resp.body, null, 2) + "\n\n"
-      + "Please open an issue at https://git.coolaj86.com/coolaj86/acme-v2.js"
-      ));
-    });
-  }
-
-  return pollCert();
 };
 // _kid
 // registerAccount
@@ -686,16 +676,18 @@ ACME._getCertificate = function (me, options) {
   }
   if (!(options.domains && options.domains.length)) {
     return Promise.reject(new Error("options.domains must be a list of string domain names,"
-    + " with the first being the subject of the domain (or options.subject must specified)."));
+    + " with the first being the subject of the certificate (or options.subject must specified)."));
   }
 
-  // It's just fine if there's no account, we'll go get the key id we need via the public key
+  // It's just fine if there's no account, we'll go get the key id we need via the existing key
-  if (options.accountKid || options.account && options.account.kid) {
+  options._kid = options._kid || options.accountKid
-    options._kid = options.accountKid || options.account.kid;
+    || (options.account && (options.account.kid
-  } else {
+      || (options.account.key && options.account.key.kid)));
+  if (!options._kid) {
     //return Promise.reject(new Error("must include KeyID"));
     // This is an idempotent request. It'll return the same account for the same public key.
-    return ACME._registerAccount(me, options).then(function () {
+    return ACME._registerAccount(me, options).then(function (account) {
+      options._kid = account.key.kid;
       // start back from the top
       return ACME._getCertificate(me, options);
     });
@@ -720,9 +712,6 @@ ACME._getCertificate = function (me, options) {
     };
 
     var payload = JSON.stringify(body);
-    // determine the signing algorithm to use in protected header // TODO isn't that handled by the signer?
-    options._kty = (options.accountKeypair.privateKeyJwk && options.accountKeypair.privateKeyJwk.kty || 'RSA');
-    options._alg = ('EC' === options._kty) ? 'ES256' : 'RS256'; // TODO vary with bitwidth of key (if not handled)
     if (me.debug) { console.debug('\n[DEBUG] newOrder\n'); }
     return ACME._jwsRequest({
       options: options
@@ -815,6 +804,13 @@ ACME._getCertificate = function (me, options) {
     });
   });
 };
+ACME._generateCsrWeb64 = function (me, options, validatedDomains) {
+  return ACME._importKeypair(me, options.domainKeypair).then(function (/*pair*/) {
+    return me.Keypairs.generateCsr(options.domainKeypair, validatedDomains).then(function (der) {
+      return Enc.bufToUrlBase64(der);
+    });
+  });
+};
 
 ACME.create = function create(me) {
   if (!me) { me = {}; }
@@ -827,17 +823,15 @@ ACME.create = function create(me) {
   if (!me.dig) {
     me.dig = function (query) {
       // TODO use digd.js
-      return new Promise(function (resolve, reject) {
+      return new me.request({ url: "/api/dns/" + query.name + "?type=" + query.type }).then(function (resp) {
-        var dns = require('dns');
+        if (!resp.body || !Array.isArray(resp.body.answer)) {
-        dns.resolveTxt(query.name, function (err, records) {
+          throw new Error("failed to get DNS response");
-          if (err) { reject(err); return; }
+        }
-
+        return {
-          resolve({
+          answer: resp.body.answer.map(function (ans) {
-            answer: records.map(function (rr) {
+            return { data: ans.data, ttl: ans.ttl };
-              return { data: rr };
+          })
-            })
+        };
-          });
-        });
       });
     };
   }
@@ -942,6 +936,30 @@ ACME._defaultRequest = function (opts) {
     });
   });
 };
+
+ACME._importKeypair = function (me, kp) {
+  var jwk = kp.privateKeyJwk;
+  var p;
+  if (jwk) {
+    // nix the browser jwk extras
+    jwk.key_ops = undefined;
+    jwk.ext = undefined;
+    p = Promise.resolve({ private: jwk, public: me.Keypairs.neuter({ jwk: jwk }) });
+  } else {
+    p = me.Keypairs.import({ pem: kp.privateKeyPem });
+  }
+  return p.then(function (pair) {
+    kp.privateKeyJwk = pair.private;
+    kp.publicKeyJwk = pair.public;
+    if (pair.public.kid) {
+      pair = JSON.parse(JSON.stringify(pair));
+      delete pair.public.kid;
+      delete pair.private.kid;
+    }
+    return pair;
+  });
+};
+
 /*
 TODO
 Per-Order State Params

package-lock.json

@@ -0,0 +1,547 @@
+{
+  "name": "bluecrypt-keypairs",
+  "version": "0.1.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "accepts": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.6.tgz",
+      "integrity": "sha512-QsaoUD2dpVpjENy8JFpQnXP9vyzoZPmAoKrE3S6HtSB7qzSebkJNnmdY4p004FQUSSiHXPueENpoeuUW/7a8Ig==",
+      "dev": true,
+      "requires": {
+        "mime-types": "~2.1.24",
+        "negotiator": "0.6.1"
+      }
+    },
+    "array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI=",
+      "dev": true
+    },
+    "balanced-match": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
+      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c=",
+      "dev": true
+    },
+    "bluebird": {
+      "version": "3.5.4",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.5.4.tgz",
+      "integrity": "sha512-FG+nFEZChJrbQ9tIccIfZJBz3J7mLrAhxakAbnrJWn8d7aKOC+LWifa0G+p4ZqKp4y13T7juYvdhq9NzKdsrjw==",
+      "dev": true
+    },
+    "body-parser": {
+      "version": "1.18.3",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz",
+      "integrity": "sha1-WykhmP/dVTs6DyDe0FkrlWlVyLQ=",
+      "dev": true,
+      "requires": {
+        "bytes": "3.0.0",
+        "content-type": "~1.0.4",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "http-errors": "~1.6.3",
+        "iconv-lite": "0.4.23",
+        "on-finished": "~2.3.0",
+        "qs": "6.5.2",
+        "raw-body": "2.3.3",
+        "type-is": "~1.6.16"
+      }
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "bytes": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
+      "integrity": "sha1-0ygVQE1olpn4Wk6k+odV3ROpYEg=",
+      "dev": true
+    },
+    "cli": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/cli/-/cli-1.0.1.tgz",
+      "integrity": "sha1-IoF1NPJL+klQw01TLUjsvGIbjBQ=",
+      "dev": true,
+      "requires": {
+        "exit": "0.1.2",
+        "glob": "^7.1.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
+      "dev": true
+    },
+    "content-disposition": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.2.tgz",
+      "integrity": "sha1-DPaLud318r55YcOoUXjLhdunjLQ=",
+      "dev": true
+    },
+    "content-type": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
+      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA==",
+      "dev": true
+    },
+    "cookie": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.3.1.tgz",
+      "integrity": "sha1-5+Ch+e9DtMi6klxcWpboBtFoc7s=",
+      "dev": true
+    },
+    "cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw=",
+      "dev": true
+    },
+    "debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "requires": {
+        "ms": "2.0.0"
+      }
+    },
+    "depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha1-m81S4UwJd2PnSbJ0xDRu0uVgtak=",
+      "dev": true
+    },
+    "destroy": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.0.4.tgz",
+      "integrity": "sha1-l4hXRCxEdJ5CBmE+N5RiBYJqvYA=",
+      "dev": true
+    },
+    "dig.js": {
+      "version": "1.3.9",
+      "resolved": "https://registry.npmjs.org/dig.js/-/dig.js-1.3.9.tgz",
+      "integrity": "sha512-O/tSWZuW7AwpjsgePPmTanwvSDL9xF+FzLTJD9byN3C6lk79iMejC/Ahz9CERAXTW4e2TXL1vtqh3T0Ug79ocA==",
+      "dev": true,
+      "requires": {
+        "cli": "^1.0.1",
+        "dns-suite": "git+https://git.coolaj86.com/coolaj86/dns-suite.js#v1.2",
+        "hexdump.js": "git+https://git.coolaj86.com/coolaj86/hexdump.js#v1.0.4"
+      },
+      "dependencies": {
+        "dns-suite": {
+          "version": "git+https://git.coolaj86.com/coolaj86/dns-suite.js#092008f766540909d27c934211495c9e03705bf3",
+          "from": "git+https://git.coolaj86.com/coolaj86/dns-suite.js#v1.2",
+          "dev": true,
+          "requires": {
+            "bluebird": "^3.5.0",
+            "hexdump.js": "git+https://git.coolaj86.com/coolaj86/hexdump.js#v1.0.4"
+          }
+        }
+      }
+    },
+    "dns-suite": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/dns-suite/-/dns-suite-1.2.12.tgz",
+      "integrity": "sha512-K4LWqmJT/T2QLaGCJ+qRvrT9DicKs5XxXYXw6uIZ1apdwyfToQk7K9AZbpFd0FLRdZG809v2vAcsquPbQh+Ipg==",
+      "dev": true,
+      "requires": {
+        "bluebird": "^3.5.0",
+        "hexdump.js": "git+https://git.coolaj86.com/coolaj86/hexdump.js#v1.0.4"
+      }
+    },
+    "ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0=",
+      "dev": true
+    },
+    "encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k=",
+      "dev": true
+    },
+    "escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg=",
+      "dev": true
+    },
+    "etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc=",
+      "dev": true
+    },
+    "exit": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
+      "integrity": "sha1-BjJjj42HfMghB9MKD/8aF8uhzQw=",
+      "dev": true
+    },
+    "express": {
+      "version": "4.16.4",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.16.4.tgz",
+      "integrity": "sha512-j12Uuyb4FMrd/qQAm6uCHAkPtO8FDTRJZBDd5D2KOL2eLaz1yUNdUB/NOIyq0iU4q4cFarsUCrnFDPBcnksuOg==",
+      "dev": true,
+      "requires": {
+        "accepts": "~1.3.5",
+        "array-flatten": "1.1.1",
+        "body-parser": "1.18.3",
+        "content-disposition": "0.5.2",
+        "content-type": "~1.0.4",
+        "cookie": "0.3.1",
+        "cookie-signature": "1.0.6",
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "1.1.1",
+        "fresh": "0.5.2",
+        "merge-descriptors": "1.0.1",
+        "methods": "~1.1.2",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.2",
+        "path-to-regexp": "0.1.7",
+        "proxy-addr": "~2.0.4",
+        "qs": "6.5.2",
+        "range-parser": "~1.2.0",
+        "safe-buffer": "5.1.2",
+        "send": "0.16.2",
+        "serve-static": "1.13.2",
+        "setprototypeof": "1.1.0",
+        "statuses": "~1.4.0",
+        "type-is": "~1.6.16",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      }
+    },
+    "finalhandler": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.1.tgz",
+      "integrity": "sha512-Y1GUDo39ez4aHAw7MysnUD5JzYX+WaIj8I57kO3aEPT1fFRL4sr7mjei97FgnwhAyyzRYmQZaTHb2+9uZ1dPtg==",
+      "dev": true,
+      "requires": {
+        "debug": "2.6.9",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "on-finished": "~2.3.0",
+        "parseurl": "~1.3.2",
+        "statuses": "~1.4.0",
+        "unpipe": "~1.0.0"
+      }
+    },
+    "forwarded": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.1.2.tgz",
+      "integrity": "sha1-mMI9qxF1ZXuMBXPozszZGw/xjIQ=",
+      "dev": true
+    },
+    "fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac=",
+      "dev": true
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
+      "dev": true
+    },
+    "glob": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.3.tgz",
+      "integrity": "sha512-vcfuiIxogLV4DlGBHIUOwI0IbrJ8HWPc4MU7HzviGeNho/UJDfi6B5p3sHeWIQ0KGIU0Jpxi5ZHxemQfLkkAwQ==",
+      "dev": true,
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "hexdump.js": {
+      "version": "git+https://git.coolaj86.com/coolaj86/hexdump.js#222fa7de5036a16397de2fe703c35ac54a3d8d0c",
+      "from": "git+https://git.coolaj86.com/coolaj86/hexdump.js#v1.0.4",
+      "dev": true
+    },
+    "http-errors": {
+      "version": "1.6.3",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
+      "integrity": "sha1-i1VoC7S+KDoLW/TqLjhYC+HZMg0=",
+      "dev": true,
+      "requires": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.3",
+        "setprototypeof": "1.1.0",
+        "statuses": ">= 1.4.0 < 2"
+      }
+    },
+    "iconv-lite": {
+      "version": "0.4.23",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.23.tgz",
+      "integrity": "sha512-neyTUVFtahjf0mB3dZT77u+8O0QB89jFdnBkd5P1JgYPbPaia3gXXOVL2fq8VyU2gMMD7SaN7QukTB/pmXYvDA==",
+      "dev": true,
+      "requires": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
+      "dev": true,
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+      "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=",
+      "dev": true
+    },
+    "ipaddr.js": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.0.tgz",
+      "integrity": "sha512-M4Sjn6N/+O6/IXSJseKqHoFc+5FdGJ22sXqnjTpdZweHK64MzEPAyQZyEU3R/KRv2GLoa7nNtg/C2Ev6m7z+eA==",
+      "dev": true
+    },
+    "media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha1-hxDXrwqmJvj/+hzgAWhUUmMlV0g=",
+      "dev": true
+    },
+    "merge-descriptors": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
+      "integrity": "sha1-sAqqVW3YtEVoFQ7J0blT8/kMu2E=",
+      "dev": true
+    },
+    "methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4=",
+      "dev": true
+    },
+    "mime": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.4.1.tgz",
+      "integrity": "sha512-KI1+qOZu5DcW6wayYHSzR/tXKCDC5Om4s1z2QJjDULzLcmf3DvzS7oluY4HCTrc+9FiKmWUgeNLg7W3uIQvxtQ==",
+      "dev": true
+    },
+    "mime-db": {
+      "version": "1.40.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.40.0.tgz",
+      "integrity": "sha512-jYdeOMPy9vnxEqFRRo6ZvTZ8d9oPb+k18PKoYNYUe2stVEBPPwsln/qWzdbmaIvnhZ9v2P+CuecK+fpUfsV2mA==",
+      "dev": true
+    },
+    "mime-types": {
+      "version": "2.1.24",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.24.tgz",
+      "integrity": "sha512-WaFHS3MCl5fapm3oLxU4eYDw77IQM2ACcxQ9RIxfaC3ooc6PFuBMGZZsYpvoXS5D5QTWPieo1jjLdAm3TBP3cQ==",
+      "dev": true,
+      "requires": {
+        "mime-db": "1.40.0"
+      }
+    },
+    "minimatch": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "dev": true,
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
+      "dev": true
+    },
+    "negotiator": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.1.tgz",
+      "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk=",
+      "dev": true
+    },
+    "on-finished": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
+      "integrity": "sha1-IPEzZIGwg811M3mSoWlxqi2QaUc=",
+      "dev": true,
+      "requires": {
+        "ee-first": "1.1.1"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
+      "dev": true
+    },
+    "path-to-regexp": {
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
+      "integrity": "sha1-32BBeABfUi8V60SQ5yR6G/qmf4w=",
+      "dev": true
+    },
+    "proxy-addr": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.5.tgz",
+      "integrity": "sha512-t/7RxHXPH6cJtP0pRG6smSr9QJidhB+3kXu0KgXnbGYMgzEnUxRQ4/LDdfOwZEMyIh3/xHb8PX3t+lfL9z+YVQ==",
+      "dev": true,
+      "requires": {
+        "forwarded": "~0.1.2",
+        "ipaddr.js": "1.9.0"
+      }
+    },
+    "qs": {
+      "version": "6.5.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz",
+      "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==",
+      "dev": true
+    },
+    "range-parser": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.0.tgz",
+      "integrity": "sha1-9JvmtIeJTdxA3MlKMi9hEJLgDV4=",
+      "dev": true
+    },
+    "raw-body": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.3.3.tgz",
+      "integrity": "sha512-9esiElv1BrZoI3rCDuOuKCBRbuApGGaDPQfjSflGxdy4oyzqghxu6klEkkVIvBje+FF0BX9coEv8KqW6X/7njw==",
+      "dev": true,
+      "requires": {
+        "bytes": "3.0.0",
+        "http-errors": "1.6.3",
+        "iconv-lite": "0.4.23",
+        "unpipe": "1.0.0"
+      }
+    },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true
+    },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true
+    },
+    "send": {
+      "version": "0.16.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.16.2.tgz",
+      "integrity": "sha512-E64YFPUssFHEFBvpbbjr44NCLtI1AohxQ8ZSiJjQLskAdKuriYEP6VyGEsRDH8ScozGpkaX1BGvhanqCwkcEZw==",
+      "dev": true,
+      "requires": {
+        "debug": "2.6.9",
+        "depd": "~1.1.2",
+        "destroy": "~1.0.4",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "0.5.2",
+        "http-errors": "~1.6.2",
+        "mime": "1.4.1",
+        "ms": "2.0.0",
+        "on-finished": "~2.3.0",
+        "range-parser": "~1.2.0",
+        "statuses": "~1.4.0"
+      }
+    },
+    "serve-static": {
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.13.2.tgz",
+      "integrity": "sha512-p/tdJrO4U387R9oMjb1oj7qSMaMfmOyd4j9hOFoxZe2baQszgHcSWjuya/CiT5kgZZKRudHNOA0pYXOl8rQ5nw==",
+      "dev": true,
+      "requires": {
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.2",
+        "send": "0.16.2"
+      }
+    },
+    "setprototypeof": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.0.tgz",
+      "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ==",
+      "dev": true
+    },
+    "statuses": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.4.0.tgz",
+      "integrity": "sha512-zhSCtt8v2NDrRlPQpCNtw/heZLtfUDqxBM1udqikb/Hbk52LK4nQSwr10u77iopCW5LsyHpuXS0GnEc48mLeew==",
+      "dev": true
+    },
+    "type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "dev": true,
+      "requires": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      }
+    },
+    "unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha1-sr9O6FFKrmFltIF4KdIbLvSZBOw=",
+      "dev": true
+    },
+    "utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM=",
+      "dev": true
+    },
+    "vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw=",
+      "dev": true
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
+    }
+  }
+}

package.json

@@ -0,0 +1,36 @@
+{
+  "name": "bluecrypt-keypairs",
+  "version": "0.1.0",
+  "description": "Zero-Dependency Native Browser support for ECDSA P-256 and P-384, and RSA 2048/3072/4096 written in VanillaJS",
+  "main": "server.js",
+  "directories": {
+    "lib": "lib"
+  },
+  "scripts": {
+    "test": "node server.js",
+    "start": "node server.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://git.coolaj86.com/coolaj86/bluecrypt-keypairs.js.git"
+  },
+  "keywords": [
+    "browser",
+    "EC",
+    "RSA",
+    "ECDSA",
+    "P-256",
+    "P-384",
+    "bluecrypt",
+    "keypairs",
+    "greenlock",
+    "VanillaJS"
+  ],
+  "author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
+  "license": "MPL-2.0",
+  "devDependencies": {
+    "dig.js": "^1.3.9",
+    "dns-suite": "^1.2.12",
+    "express": "^4.16.4"
+  }
+}

server.js

@@ -0,0 +1,125 @@
+'use strict';
+
+var crypto = require('crypto');
+//var dnsjs = require('dns-suite');
+var dig = require('dig.js/dns-request');
+var express = require('express');
+var app = express();
+
+var nameservers = require('dns').getServers();
+var index = crypto.randomBytes(2).readUInt16BE(0) % nameservers.length;
+var nameserver = nameservers[index];
+
+app.use('/', express.static('./'));
+app.use('/api', express.json());
+app.get('/api/dns/:domain', function (req, res, next) {
+  console.log(req.params);
+  var domain = req.params.domain;
+  var casedDomain = domain.toLowerCase().split('').map(function (ch) {
+		// dns0x20 takes advantage of the fact that the binary operation for toUpperCase is
+		// ch = ch | 0x20;
+		return Math.round(Math.random()) % 2 ? ch : ch.toUpperCase();
+	}).join('');
+  var typ = req.query.type;
+  var query = {
+    header: {
+      id: crypto.randomBytes(2).readUInt16BE(0)
+    , qr: 0
+    , opcode: 0
+    , aa: 0 // Authoritative-Only
+    , tc: 0                   // NA
+    , rd: 1 // Recurse
+    , ra: 0                   // NA
+    , rcode: 0                // NA
+    }
+  , question: [
+      { name: casedDomain
+      //, type: typ || 'A'
+      , typeName: typ || 'A'
+      , className: 'IN'
+      }
+    ]
+  };
+	var opts = {
+    onError: function (err) {
+			next(err);
+		}
+  , onMessage: function (packet) {
+			var fail0x20;
+
+			if (packet.id !== query.id) {
+				console.error('[SECURITY] ignoring packet for \'' + packet.question[0].name + '\' due to mismatched id');
+				console.error(packet);
+				return;
+			}
+
+			packet.question.forEach(function (q) {
+				// if (-1 === q.name.lastIndexOf(cli.casedQuery))
+				if (q.name !== casedDomain) {
+					fail0x20 = q.name;
+				}
+			});
+
+			[ 'question', 'answer', 'authority', 'additional' ].forEach(function (group) {
+				(packet[group]||[]).forEach(function (a) {
+					var an = a.name;
+					var i = domain.toLowerCase().lastIndexOf(a.name.toLowerCase());  // answer is something like ExAMPle.cOM and query was wWw.ExAMPle.cOM
+					var j = a.name.toLowerCase().lastIndexOf(domain.toLowerCase());  // answer is something like www.ExAMPle.cOM and query was ExAMPle.cOM
+
+					// it's important to note that these should only relpace changes in casing that we expected
+					// any abnormalities should be left intact to go "huh?" about
+					// TODO detect abnormalities?
+					if (-1 !== i) {
+						// "EXamPLE.cOm".replace("wWw.EXamPLE.cOm".substr(4), "www.example.com".substr(4))
+						a.name = a.name.replace(casedDomain.substr(i), domain.substr(i));
+					} else if (-1 !== j) {
+						// "www.example.com".replace("EXamPLE.cOm", "example.com")
+						a.name = a.name.substr(0, j) + a.name.substr(j).replace(casedDomain, domain);
+					}
+
+					// NOTE: right now this assumes that anything matching the query matches all the way to the end
+					// it does not handle the case of a record for example.com.uk being returned in response to a query for www.example.com correctly
+					// (but I don't think it should need to)
+					if (a.name.length !== an.length) {
+						console.error("[ERROR] question / answer mismatch: '" + an + "' != '" + a.length + "'");
+						console.error(a);
+					}
+				});
+			});
+
+			if (fail0x20) {
+				console.warn(";; Warning: DNS 0x20 security not implemented (or packet spoofed). Queried '"
+					+ casedDomain + "' but got response for '" + fail0x20 + "'.");
+				return;
+			}
+
+			res.send({
+        header: packet.header
+      , question: packet.question
+      , answer: packet.answer
+      , authority: packet.authority
+      , additional: packet.additional
+      , edns_options: packet.edns_options
+      });
+		}
+  , onListening: function () {}
+  , onSent: function (/*res*/) { }
+  , onTimeout: function (res) {
+			console.error('dns timeout:', res);
+			next(new Error("DNS timeout - no response"));
+    }
+  , onClose: function () { }
+  //, mdns: cli.mdns
+  , nameserver: nameserver
+  , port: 53
+  , timeout: 2000
+  };
+
+  dig.resolveJson(query, opts);
+});
+
+// curl -L http://localhost:3000/api/dns/example.com?type=A
+console.log("Listening on localhost:3000");
+app.listen(3000);
+console.log("Try this:");
+console.log("\tcurl -L 'http://localhost:3000/api/dns/example.com?type=A'");