# Enabling Asynchronous Order Finalization

**URL:** <https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522>\
**Category:** API Announcements\
**Created:** [February 27, 2023, 4:30pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522 "2023-02-27T16:30:43Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![aarongable](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aarongable/32/42043_2.png) [@aarongable](https://community.letsencrypt.org/u/aarongable)\
**Post date:** [February 27, 2023, 4:30pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/1 "2023-02-27T16:30:43Z")

</div>

We intend to make all order finalization **asynchronous** in the near future. This means that requests to the `finalize` URL included in Order objects will return very quickly, with the Order in `"status": "processing"`. Clients will then have to poll the Order's URL until it transitions to `"status": "valid"`, at which point they will be able to fetch the issued certificate as usual.

This is a change from the current status quo, in which successful requests to finalize orders always return with the order in `"status": "valid"` and the certificate ready to download. We are making this change because such synchronous requests often take a long time due to external dependencies (CT logs for precertificate submissions and DNS for CAA rechecking) and sometimes fail simply due to client-side timeouts. We expect this change to increase our overall issuance success rate, especially when those external dependencies are experiencing slowness or outages.

This asynchronous flow has always been [specified in RFC8555](https://www.rfc-editor.org/rfc/rfc8555.html#section-7.4.2:~:text=If%20a%20request%20to%20finalize%20an%20order%20is%20successful). Other ACME servers such as ZeroSSL and Google Trust Services already conduct finalization asynchronously. Therefore we do not expect this change to cause breakage with many clients.

However, due to the possibility of breakage, we intend to follow a "brownout"-style schedule for deploying this change:

- March 15: 24 hours in Staging
- March 17-20: a whole weekend in Staging
- March 27: enabled permanently in Staging

Assuming the Staging rollout goes smoothly, then:

- April 5: 8 hours in Prod
- ~~April 10: 24 hours in Prod~~
- ~~April 14-17: a whole weekend in Prod~~
- ~~April 24: enabled permanently in Prod~~

All of the above dates are subject to change; watch this post for updates. As always, if you run into issues with this change, please post the details of your situation in the #help section of this forum.

---

<div class="post-metadata">

**Author:** ![JamesLE](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jamesle/32/49364_2.png) [@JamesLE](https://community.letsencrypt.org/u/JamesLE)\
**Post date:** [March 1, 2023, 2:22am UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/2 "2023-03-01T02:22:09Z")

</div>

Due to [issues with this week's Staging deploy](https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/63ff04f60f35d90534fe1ab6), we are skipping the March 1 brownout in Staging. We plan to continue the rest of the rollout as scheduled.

---

<div class="post-metadata">

**Author:** ![jcjones](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jcjones/32/78_2.png) [@jcjones](https://community.letsencrypt.org/u/jcjones)\
**Post date:** [March 6, 2023, 6:13pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/3 "2023-03-06T18:13:58Z")

</div>

We're moving today's brownout to Wednesday, March 8th:

- March 8: 24 hours in Staging

---

<div class="post-metadata">

**Author:** ![jcjones](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jcjones/32/78_2.png) [@jcjones](https://community.letsencrypt.org/u/jcjones)\
**Post date:** [March 7, 2023, 8:08pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/4 "2023-03-07T20:08:11Z")

</div>

The brownouts for Staging are going to start another week later. I've updated the post; the first Staging brownout now will be 24 hours on 15 March.

---

<div class="post-metadata">

**Author:** ![aarongable](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aarongable/32/42043_2.png) [@aarongable](https://community.letsencrypt.org/u/aarongable)\
**Post date:** [April 3, 2023, 9:27pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/5 "2023-04-03T21:27:03Z")

</div>

This has been (quietly) enabled continuously in Staging for a week now. We have not seen any increase in errors, nor have we received any complaints or bug reports from clients issuing against Staging.

We intend to proceed with brownouts in Prod as originally scheduled, starting with 8 hours this Wednesday, April 5th.

---

<div class="post-metadata">

**Author:** ![jcjones](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jcjones/32/78_2.png) [@jcjones](https://community.letsencrypt.org/u/jcjones)\
**Post date:** [April 5, 2023, 5:55pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/6 "2023-04-05T17:55:40Z")

</div>

We enabled this in production at 17:07 UTC today, about 45 minutes ago. We will disable it approximately 00:00 or 01:00 UTC tomorrow, in ~8 hours

---

<div class="post-metadata">

**Author:** ![lenaunderwood](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/lenaunderwood/32/78053_2.png) [@lenaunderwood](https://community.letsencrypt.org/u/lenaunderwood)\
**Post date:** [April 5, 2023, 10:28pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/7 "2023-04-05T22:28:47Z")

</div>

This has been disabled early, as of 22:16 UTC today.

---

<div class="post-metadata">

**Author:** ![aarongable](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/aarongable/32/42043_2.png) [@aarongable](https://community.letsencrypt.org/u/aarongable)\
**Post date:** [April 6, 2023, 7:17pm UTC](https://community.letsencrypt.org/t/enabling-asynchronous-order-finalization/193522/8 "2023-04-06T19:17:32Z")

</div>

Our brownout yesterday was very successful, giving us lots of useful data on which clients do and do not support async finalization. Based on that data and the great conversations in this forum yesterday, we've decided to cancel the rest of the prod brownouts, and to indefinitely postpone enabling asynchronous finalization in prod.

This change is one that we'd still love to make someday, but we have multiple other public-facing changes that we'd like to make this year. Those other changes are higher priority, and so we'd rather focus our efforts on ensuring that those changes go well.

If you are a **client author** , please continue work to support asynchronous finalization. It's necessary to be compliant with RFC 8555, and to interoperate with ACME servers other than Let's Encrypt.

If you are a **website operator** , please update or change your ACME client to one that supports asynchronous finalization for the same reason as above.

We'll leave async finalization enabled in Staging for an extended period, to allow client authors and website operators to test and verify that their clients work with it.

Please keep an eye out for further announcements regarding the other changes we intend to make this year. Exciting times are ahead!
