Subject: Re: [Acme] Conflicting requirements for retrieving an ACME account that is already bound to an external account

From: John Gardiner Myers <[email-masked]>
Date: Wed, 18 Nov 2020 15:30:20 -0800

> Clients already have to store one piece of state (the account
> key), and asking them to store a second piece of state (the account URL) is
> not onerous.

I would disagree: there is a key difference between the two pieces of 
state, especially to systems using a declarative desired state and a 
reconciliation agent. The account key is determined by the client and 
thus can be made part of the declared desired state, whereas the account 
URL needs to be obtained from the server and thus can't be known until 
reconciliation has started.

With the inability to recover the account URL, it would be necessary to 
either have separate procedures for initial setup and restoration 
(backing up and restoring the account URL, respectively) or to reset or 
reprovision the external account (which is inconvenient after an event 
causing the loss of reconciliation state).