Hi I noticed that when I issue an ACME newOrder request, existing authorization object that is "valid" or "pending" is attached to the newly created order. If an order only contains this valid authorization, it is created in "ready" state. The problem is that in my case, the authorization, even v…

[image] lhuynh: The problem is that in my case, the authorization, even valid, expired 5 days ago. If I read RFC 8555 correctly, this shouldn't be possible. According to section 7.1.6 of RFC 8555 , the status of an authorization (authz) should be updated to "expired" once the time is after th…

My apologies, I misread, the authz expires next month!

Note that Let's Encrypt extends the lifetime from 7 to 30 days after it has become valid (i.e. the expires field is updated). If your client assumes that the authorization lifetime is still at its original 7 day value, the dates will be different from the actual lifetimes used by the CA.

[image] Nummer378: If your client assumes that the authorization lifetime is still at its original 7 day value (…) That would be the result of either hardcoding the 7 days validity or storing the previous "expires" value somewhere, both which shouldn't be necessary.

By the way, why the lifetime of a valid authz is extended ?

This allows LetsEncrypt to re-use the valid authorizations for 30 days across other orders for the same account key. I believe this is how they cache valid authorizations. FAQ - Let's Encrypt Not all ACME Servers / CAs will do this. It's an optimization LetsEncrypt decided to implement because t…

And also note that Let's Encrypt is contemplating changing this behavior. [image] Soliciting feedback on shortening authorization lifetimes to 7 hours Issuance Policy H…

I forgot another technical detail: LetsEncrypt will often re-use objects, but the object re-use between Boulder and Pebble operate differently – so if you're testing locally on Pebble, you might get completely different behavior under Boulder. If you're testing locally on Boulder, you may want to …

When the order becomes "ready", does its lifetime be extended also ?

Not that I have seen, but someone else may have better knowledge of the current implementation.

No, the order lifetime does not change.

Reuse of ACME authorization object

Client dev

petercooperjr July 25, 2023, 6:23pm 8

And also note that Let's Encrypt is contemplating changing this behavior.

Topic		Replies	Views
The lifecycle of a valid authorization Issuance Tech	3	1337	September 6, 2019
Will the order status remain ready? Client dev	6	991	January 10, 2024
V2 API - number of authorizations after many renewals Issuance Tech	5	821	August 28, 2019
Has there been a recent change in order/authorization reuse behavior for the Classic profile? Help	3	117	May 26, 2026
Order is sometimes ready before doing authz/challenge Help	2	469	February 21, 2023

Reuse of ACME authorization object

Related topics