Subject: [Acme] Question about listing authorization objects

From: "Zhang, Ning" <[email-masked]>
Date: Wed, 11 Apr 2018 22:07:05 +0000

Excuse me if it has been discussed before.

It looks like that there is no URL defined to fetch the list of existing authorization objects associated with an account, especially for ACME servers supporting pre-authorization

Does this mean that it is up to the specific ACME server implementation to provide such a URL for authorization objects, in a similar way for the order objects?

Thanks,
-Ning

---

From: Jacob Hoffman-Andrews <[email-masked]>
Date: Wed, 11 Apr 2018 15:13:44 -0700

On 04/11/2018 03:07 PM, Zhang, Ning wrote:
> It looks like that there is no URL defined to fetch the list of
> existing authorization objects associated with an account, especially
> for ACME servers supporting pre-authorization
>
>  
>
> Does this mean that it is up to the specific ACME server
> implementation to provide such a URL for authorization objects, in a
> similar way for the order objects?
>
The assumption is that by enumerating the order objects, you can find
all the authorization objects, though it's true that doesn't hold for
servers supporting pre-authorization. For now I'd be waiting and seeing
if (a) any servers implement pre-authorization, and (b) if they decide
to implement authorization object listing as a server-specific
extension. If so, we could standardize that in a follow-on RFC.