Handling multipath setups

[hailfinger]

Hi!
I have a slightly peculiar setup with unreliable links in two parallel networks between step-ca and its (distributed) clients.

Network A is in 192.168.254.0/24, network B is in 192.168.255.0/24. Each client is hooked up to network A and network B over separate VPN links (one per network) and has an one IP address per network, e.g. 192.168.254.100 and 192.168.255.100. The step-ca server is connected to both networks as well and has one IP address per network as well.

All links are somewhat flaky, but if they work, they work well long enough to complete a challenge.

All clients currently use network A to get their certificates via HTTP-01 challenge from step-ca. DNS for each client points to the client IP in network A and DNS for step-ca points to the server IP in network A.

I would like to be able to fail over to network B for each certificate challenge where the client is not reachable via network A. More generally, as long as the client is reachable via any network, using that network is fine. There is no preferred network.

One possible avenue would be to add two A records to DNS for each client, yielding both IP addresses of the client. If step-ca were to try all A (and AAAA) records for executing the HTTP-01 challenge, that would solve the problem.
Looking at the excellent step-ca documentation didn't really yield a clue on how step-ca resolves hostnames via DNS if multiple entries for a single host are present and the first challenge/response pair fails due to timeout. Will step-ca retry challenges with the result of the first DNS resolution? Will it perform multiple lookups at the mercy of the resolver? Will it iterate over all IPs returned for A/AAAA lookups?

Another possible avenue would be ad-hoc destination IP rewriting via packet filter rules depending on reachability, but that way lies madness and I'd rather not go there.

Another possible avenue would be to run all HTTP-01 challenges through an outbound proxy and let the proxy handle failover between networks. That possibly solves the problem if the proxy is co-located with step-ca, but it's been 20 years since I last touched a Squid setup.

DNS-01 challenge wouldn't help because that just moves the problem elsewhere and then I'd have to build another tool where the clients can authenticate and I'm not trying to reinvent the wheel.

There probably is a simple solution which I can't see yet and I would appreciate any ideas, pointers to the documentation or even a "can't be done with step-ca, try something else".

[tashian]

On the server side, step-ca uses the standard Go DNS dialer, which should try each of the two A records for the host.
There's a 30 second timeout, so it should after about 15s give up on one address and try the other.
But, I'd suggest testing this.

On the client side, same rules apply. If the CA's hostname has two A records, the client should try one and then the other.