The lifecycle of a valid authorization

[munmar]

Hi

https://tools.ietf.org/html/rfc8555#page-28 says

Note that just because an authorization URL is listed in the
“authorizations” array of an order object doesn’t mean that the
client is required to take action. There are several reasons that
the referenced authorizations may already be valid:

o The client completed the authorization as part of a previous order

What can be said about how Let’s Encrypt reuses authorizations?
Once valid, how long will an authorization be reused for?

Best,
Marius

[Phil]

@munmar,

An authorization aka authz is valid for 30 days and that value is set via the RA configuration.
Example: https://github.com/letsencrypt/boulder/blob/master/test/config-next/ra.json#L10-L11

[mnordhoff]

However, that may change in the future. There is no guarantee that an authz will be valid for 30 days. The number may be changed, or some authorizations may be deactivated unexpectedly.

An ACME client should always be prepared to validate again, rather than counting on authz reuse.

[munmar]

Thanks for the details - it all sounds more or less how I imagined it to be.
I’ll be making no assumptions and be ready to validate around the clock