# Authorization already pending

**URL:** <https://community.letsencrypt.org/t/authorization-already-pending/196924>\
**Category:** Help\
**Created:** [April 22, 2023, 2:19pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924 "2023-04-22T14:19:39Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pichi](https://avatars.discourse-cdn.com/v4/letter/p/ec9cab/32.png) [@Pichi](https://community.letsencrypt.org/u/Pichi)\
**Post date:** [April 22, 2023, 2:19pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/1 "2023-04-22T14:19:39Z")

</div>

Hello,  
I'm not sure if this is the proper place to post, but here it goes.

Since a few days or weeks, i cant say exactly, creating an request to issue the actual cert, the error:  
"Unable to update challenge :: authorization must be pending"  
request is displayed. I'm using [GitHub - skoerfgen/ACMECert: PHP client library for Let's Encrypt and other ACME v2 - RFC 8555 compatible Certificate Authorities](https://github.com/skoerfgen/ACMECert/), but Yaac has the same issue.

This error doesn't disappear after a time.

Is this an recent change in acme?

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\
**Post date:** [April 22, 2023, 2:27pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/2 "2023-04-22T14:27:57Z")

</div>

> [@Unable to update challenge :: authorization must be pending. Exiting](https://community.letsencrypt.org/t/unable-to-update-challenge-authorization-must-be-pending-exiting/124054):
>
> D…

same error, what's the error actual auth link says?

---

<div class="post-metadata">

**Author:** ![stewe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stewe/32/28032_2.png) [@stewe](https://community.letsencrypt.org/u/stewe)\
**Post date:** [April 22, 2023, 6:40pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/3 "2023-04-22T18:40:31Z")

</div>

Are you using the newest version of ACMECert? (If not update and try again please)

To narrow it down it would be very helful if you could get the status of the authorization (authz) in question.

To do this you can remove the `protected` keyword from line 164 in src/ACMEv2.php to make the `request` method public. Then you can run it on your authorization url, like this:

```php
$ac=new ACMECert(....);
$ac->loadAccountKey(....);
print_r($ac->request('https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx'));

```

What response do you get?

---

<div class="post-metadata">

**Author:** ![stewe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stewe/32/28032_2.png) [@stewe](https://community.letsencrypt.org/u/stewe)\
**Post date:** [April 23, 2023, 4:56pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/4 "2023-04-23T16:56:24Z")

</div>

Update: It seems the authorization in question is not in `pending` and not in `valid` state (which it should be), when receiving the error `Unable to update challenge :: authorization must be pending`:

> <https://github.com/letsencrypt/boulder/blob/release-2023-04-17/ra/ra.go#L1718-L1724>

On the other hand, when a new Order is created, only `pending` and `valid` authorizations are reused/created:

> <https://github.com/letsencrypt/boulder/blob/release-2023-04-17/sa/saro.go#L872-L873>

So, one obvious explanation could be that there are multiple ACMECert instances running simultaneously using the same account-key and at least one common domain name. In this case they would share the same authorization(s), which then leads to this error (on the second slower instance). (It could even be on different servers running a cronjob at the same time for the same domain-names)

---

<div class="post-metadata">

**Author:** ![Pichi](https://avatars.discourse-cdn.com/v4/letter/p/ec9cab/32.png) [@Pichi](https://community.letsencrypt.org/u/Pichi)\
**Post date:** [April 24, 2023, 2:53pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/5 "2023-04-24T14:53:21Z")

</div>

So I think I have found the cause. This happens when I try to verify DNS alltho the record doesn't exist. Yaac verifies the records using Cloudflares DNS over https api, and apparently LE servers have gotten quite alot slower (or have some changed dns caching settings / cloudflare got faster). My programm didnt check for this.

The error for ACMECert seems to be not related.

Thanks for all the help.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 24, 2023, 2:53pm UTC](https://community.letsencrypt.org/t/authorization-already-pending/196924/6 "2023-05-24T14:53:22Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.