Re: [Acme] Optional "Wildcard" authorization field

[Sophie Herold <[e-mail]>]

On 02/03/18 18:32, Daniel McCarney wrote:
> Richard: That's up to the client and the situation. In the linked Certbot
> issues there were questions about error output/UX. In this case if the
> client saw an error attached to an authorization with the identifier `{
> "type": "dns", "value": "example.com"}` and the authorization had
> `wildcard: true` the client could say "Failed to authorize *.example.com:
> blah blah blah" or otherwise use the knowledge to inform their actions
> (whatever they may be).

This sounds like you want to provide the order identifiers that
triggered this authorization within the authorization object?

I think, in general it is just a guess that exmaple.com + wildcard means
that the order contains *.example.com. This depends on which
authorizations are created for which order identifiers, which is not
specified by acme.

In principle, several order identifiers could lead to a single
authorization I guess? For example, if sub1.example.org and
sub2.example.org lead to just an example.org authorization. Therefore
"orderIdentifiers", as I call it here, needs to be a list:

   {
     "status": "valid",
     "expires": "2015-03-01T14:09:00Z",

     "identifier": {
       "type": "dns",
       "value": "example.org"
     },

     "orderIdentifiers": [
       {
         "type": "dns",
         "value": "*.example.org"
       }
     ],

     "challenges": [
     …

Best,
Sophie