Tool for clearing / invalidating pending authz

One potential workaround I just remembered: If you send a GET request to a challenge URL you should get back a JSON response body with an additional Link HTTP response header with the rel=up pointing at the Authz, like so:

Link: https://acme-v01.api.letsencrypt.org/acme/authz/$IDENTIFIER_HERE;rel="up"

That should be sufficient to find the authz URL for the challenge URL's you have logged with a bit of extra work.

I think this "Up" relation might be removed in the latest versions of the draft ACME specification but it will continue to work with the existing Boulder implementation for the time being.

1 Like