rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix ACME challenge retry to create fresh orders

Browse Source 
When CompleteHTTPChallenge fails, the challenge is already marked
invalid by Let's Encrypt. Retrying Accept on the same challenge
always fails with "authorization must be pending". Reset the
domain to pending with cleared challenge data so each retry
creates a new ACME order.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-03-25 09:30:14 +01:00
parent c18f0b0748
commit f0d43fd8e5
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pkg/certmanager/provisioner.go
View File

@@ -347,6 +347,15 @@ func (p *Provisioner) provisionDomainCertificate(
domain.SSLRetryCount = domain.SSLRetryCount + 1
domain.SSLLastAttemptAt = new(time.Now())
// Clear challenge data and reset to pending so the next attempt
// creates a fresh ACME order. Once a challenge fails validation,
// Let's Encrypt marks it as invalid and retrying the same
// challenge always fails with "authorization must be pending".
domain.HTTPChallengeToken = nil
domain.HTTPChallengeKeyAuth = nil
domain.HTTPChallengeURL = nil
domain.HTTPOrderURL = nil
if domain.SSLRetryCount >= maxRetries {
p.logger.ErrorCtx(
ctx,
@@ -356,10 +365,8 @@ func (p *Provisioner) provisionDomainCertificate(
)
domain.SSLStatus = coredata.CustomDomainSSLStatusFailed
domain.HTTPChallengeToken = nil
domain.HTTPChallengeKeyAuth = nil
domain.HTTPChallengeURL = nil
domain.HTTPOrderURL = nil
} else {
domain.SSLStatus = coredata.CustomDomainSSLStatusPending
}
if err := domain.Update(ctx, tx, coredata.NewNoScope()); err != nil {