Informational on ACME: how frequently do I have to present challenge

[cpu]

Hi @lukemassa

@lukemassa

they don’t seem to cover the topic of whether this is a one-time-only setup or whether it needs to be reviewed.

Each domain authorization associated with your ACME account will be valid for 30 days after it is created (See the very last FAQ question here). You won't have to re-create the challenge response setup within those 30 days to issue another certificate that includes the same domain. If you deactivate the authorization, switch ACME accounts, or wait 30+ days then you'll need to solve another domain validation challenge for the domain in order to be authorized to issue certificates for it.

As a note: each time you need to perform the challenges the response will be different. That is, the HTTP-01 or DNS-01 challenge response you configured today won't be the same value as you'll use in 31 days from now when the original authorization has expired.

@lukemassa

my question is about my authorized key pair. If I understand correctly that is not a certificate is not signed by Let’s Encrypt, and is instead just used to sign the nonce. Unless I’m wrong and my authorized key pair is actually a self-signed cert that I must put in an expiration of 90 days into myself?

You can think of your ACME account keypair as your username/password in a more traditional service. You use it to authenticate requests to the CA when issuing a certificate. You can also use the ACME account keypair to revoke certificates you previously issued. It isn't a certificate, just a public key and an associated private key.

Hope that helps explain!