letsencrypt / letsencrypt/boulder
mtc: figure out how to gate order "ready" status on availability of subtree signatures
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Our plan so far is that the RA's FinalizeOrder call is done once a TBSCertificateLogEntry is issued. The ACME client will then poll the order object until it goes from "processing" to "valid".
Conceptually, the order is "valid" once a request to the MTCB will succeed, or in other words when the necessary two cosignatures are available.
Right now, the WFE calls SA.GetOrder directly, and renders the result. The SA determines an order's status by synthesizing various fields (see model.go: statusForOrder). In particular an order is "valid" if all its authzs are valid and the certificate serial number is non-empty.
One option would be for the WFE to start calling the RA to get order status, and have the RA check with MTCB if the order is for an MTC profile.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with model.go and statusForOrder, then trace how the WFE calls SA.GetOrder and renders the order status. Read the RA FinalizeOrder flow and the MTCB interaction described in the issue. Done means an agreed implementation makes MTC orders become valid only when the necessary two cosignatures are available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100