Subject: [Acme] Order states after finalize

From: Jonathan Rudenberg <[email-masked]>
Date: Sun, 7 Jan 2018 20:49:24 -0500

Section 7.4. (Applying for Certificate Issuance) says:

> A valid request to finalize an order will return the order to be
> finalized.  The client should begin polling the order by sending a
> GET request to the order resource to obtain its current state.  The
> status of the order will indicate what action the client should take:
>
...
>
> o  "pending": The server does not believe that the client has
>    fulfilled the requirements.  Check the "authorizations" array for
>    entries that are still pending.

This raises a couple questions:

1) Is it valid for an ACME server to respond to a finalization request with an order status of pending if the requirements have been fulfilled?
2) Is it valid for for an ACME server to respond to a “GET order” request with a status of pending after finalization if the requirements have been fulfilled?

Pebble currently does both, as it transitions to the processing status asynchronously. My understanding is that Boulder transitions to valid synchronously, without any intermediate statuses being visible to the client.

My initial understanding is that the answer to first question is yes given the explicit suggestion that the client needs to request the order again to get the current state, and the answer to the second is no, subsequent requests should never return a pending state if the requirements are valid because there is no way to distinguish indefinitely pending from pending soon-to-be processing if the answer is yes.

Jonathan