Cannot update challenge with status valid, only status pending about pebble HOT 4 CLOSED

Hi @iftahbe, thank you for the very detailed bug report! I appreciate it :-)

During the challenge authorization stage, pebble completes the challenge and the authorization status is changed to "valid" (according to the Pebble console output) but in the HTTP response we still get the "pending" status.

Based on the Fiddler trace & Pebble output it looks like you are:

1. Creating a new order
2. GETing the order
3. GETing the order's authorization
4. POSTing the authorization's DNS-01 challenge
5. POSTing the authorization's DNS-01 challenge
6. POSTing the authorization's DNS-01 challenge
   ....
7. Eventually getting an error about updating an already valid challenge.

It sounds like you wanted to be polling the authorization to see when it has changed from "pending" to "valid". This should be done by sending a GET request to the authorization URL. Instead, it seems like you are POSTing the challenge over and over - each time it returns "status":"pending" because it is still pending from the initial POSTs. After the first validation completes the status changes to "valid" and then any additional POSTs to the challenge return an error "Cannot update challenge with status valid, only status pending".

E.g. I'd expect the flow for a single identifier order to be more like:

1. Creating a new order
2. GETing the new order
3. GETing the order's authorization
4. POSTing the authorization's DNS-01 challenge
5. GETing the order's authorization (Repeat until status != "pending")
6. POSTing the order's finalize URL if the order's authorization is now "valid"
7. GETing the order (Repeat until certificate URL is present)
8. GETing the certificate URL

I don't think there is a bug here. The error you are getting from Pebble is the one I would expect to be delivered to a client that behaved like yours did in the logs :-)

Does that make sense?

from pebble.

FWIW: Starting Pebble with PEBBLE_VA_NOSLEEP=1 should make this even more apparent: The first challenge POST will result in a near-immediate change in the authorization from "pending" -> "valid" and you will see the "Cannot update challenge with status valid" error much sooner as a result.

from pebble.

@cpu Thanks a lot for the explanation.
It makes sense yes, I tried to get the status from the challenge itself and not from the order.
I will make the necessary changes :)

from pebble.

@iftahbe Great :-)

It makes sense yes, I tried to get the status from the challenge itself and not from the order.

Just to clarify quickly: you can get the individual authorization's statuses as well but you should do so with a GET request and not a POST.

from pebble.