Close cert provisioning correctness gaps

Several race and validity gaps could leave certificate provisioning
stuck, unusable, or noisy:

- Accept the HTTP-01 challenge only after the key authorization is
  committed, so the CA cannot hit the token before this instance can
  serve it and invalidate the order.
- Persist challenge metadata under a blocking write-back lock; a row
  merely locked by a competing transaction no longer silently drops the
  accepted order.
- Abandon a recovered VALID order and restart instead of issuing it
  with a freshly generated key that cannot match the existing cert.
- Exclude rate-limited rows from the ten-minute stale reset so the
  resumable order survives the ACME cooldown.
- Size the provisioning poll lease to exceed the max processing window
  so a released claim lock cannot let another worker process the same
  row concurrently.
- Parse Retry-After as unsigned seconds and clamp overflow so malformed
  values fall back to the default cooldown instead of disabling it.
- Normalize the acme_errors problem_type label to the RFC 8555 set to
  bound Prometheus cardinality.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/certmanager/acme_errors.go

@@ -23,6 +23,7 @@ package certmanager
 import (
 	"errors"
 	"fmt"
+	"math"
 	"net/http"
 	"strconv"
 	"time"
@@ -72,11 +73,6 @@ func (e *ACMEError) Is(target error) bool {
 	return e != nil && e.rateLimited && target == ErrACMERateLimited
 }
 
-// RetryAfter returns how long callers should wait before retrying.
-// For rate-limited errors it honors the ACME Retry-After value whenever the
-// header is present and parseable — including a zero (or past) value, which the
-// CA uses to permit an immediate retry. It falls back to defaultCooldown only
-// when the header is absent or invalid. Non-rate-limited errors return 0.
 func (e *ACMEError) RetryAfter() time.Duration {
 	if e == nil || !e.rateLimited {
 		return 0
@@ -131,10 +127,6 @@ func newACMEError(op string, err error) *ACMEError {
 	if _, ok := acme.RateLimit(acmeErr); ok {
 		out.rateLimited = true
 
-		// acme.RateLimit collapses "Retry-After: 0", an invalid header, and a
-		// missing header all to a zero duration, so inspect the header directly
-		// to tell an explicit zero (immediate retry) apart from an absent one
-		// (fall back to defaultCooldown in RetryAfter).
 		if retryAfter, ok := parseRetryAfter(acmeErr.Header); ok {
 			out.retryAfter = retryAfter
 			out.retryAfterSet = true
@@ -158,7 +150,17 @@ func parseRetryAfter(header http.Header) (time.Duration, bool) {
 		return 0, false
 	}
 
-	if seconds, err := strconv.Atoi(value); err == nil {
+	// The delta-seconds form is an unsigned decimal integer (RFC 9110 §10.2.3).
+	// Parsing it as unsigned rejects negative or otherwise malformed values so
+	// they fall back to the caller's default cooldown instead of collapsing to a
+	// zero/negative duration that would disable the rate-limit cooldown. A value
+	// larger than time.Duration can hold is clamped to the maximum duration.
+	if seconds, err := strconv.ParseUint(value, 10, 64); err == nil {
+		maxSeconds := uint64(math.MaxInt64 / int64(time.Second))
+		if seconds > maxSeconds {
+			return time.Duration(math.MaxInt64), true
+		}
+
 		return time.Duration(seconds) * time.Second, true
 	}