Boulder: Order <> Authorization Relationship

A short summary of Boulder's behavior:

If an existing order for the same names is in pending status, Boulder will return its url rather than creating a new one.

Otherwise, Boulder will create a new order object.

That order object may contain a mix of new pending authorizations, reused pending authorizations, and reused valid authorizations. Boulder will prefer valid over pending, and pending over creating a new authorization.

As you've noticed there is a many to many relationship between Orders and authorizations. One order can contain multiple authorizations (for different names), and one authorization can be a member of multiple orders (that all contain the same name).

FWIW, I think we'll probably keep the Pebble divergence. Our goal with Pebble is to be a testbed for the ACME protocol rather than to mimic Boulder. So to some extent, if we have differences where both Pebble and Boulder are valid according to spec, that's useful for making sure clients don't overfit Boulder's behavior.

2 Likes