letsencrypt / letsencrypt/boulder
One order can result in multiple certificates
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
We rely on an UPDATE ... WHERE ... to guarantee a single certificate per order, but at our current level of query isolation, this doesn't actually guarantee a single unique certificate per order. We should figure out a plan to fix this.
Note: This would not result in multiple certificates with the same serial; one certificate would become "detached" from the order, but it would have a different serial.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the certificate creation path and the UPDATE ... WHERE operation described in the issue, then inspect the database transaction and query-isolation assumptions. Define a concurrency test that reproduces two certificates for one order and verify that the chosen fix preserves one unique certificate while allowing distinct serials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, sql
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100