Some questions about acme-v1

[Patches]

@jvanasco

(eg “this auth is for signing this particular certificate” or “this auth and this car are part of a session”). It looks like acme2 does that… But I was surprised to not see this during v1.

Even still it doesn't. @_az and @cpu were actually describing what happens with the ACMEv2 process where you provide a CSR twice.

With either version authorizations are bound to the account key and not any keypair provided in the CSR.

@jvanasco

In the case of a failed cert with a retry, it seems like a successfully completed challenge would not have to be completed again if done within a short timespan. I’m not planning on doing this – it just seems that acme works like that.

The timespan is 30 days:

FAQ

This old API announcement explains how it works at the API level:

Upcoming change: valid authz reuse

I…