We’re using Google Trust Services’ production ACME API (dv.acme-v02.api.pki.goog) for automated certificate issuance.
We’ve observed that when we place a new order and fetch the raw authorization object, the “expires” field is consistently set to exactly 8 days after the order’s creation time — reproduced across multiple different domains and multiple different ACME accounts.
Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization (status “valid”, no fresh challenge needed). After 8 days, a new order results in a fresh “pending” authorization requiring a new DNS-01 challenge — even though GTS’s CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days.
Questions:
-
Is this 8-day authorization validity window an intentional, documented policy — separate from the 200-day validation-data-reuse ceiling mentioned in the CP/CPS?
-
Is this duration stable/guaranteed, or could it change without notice?
-
Does this differ for wildcard domain authorizations?
Our confusion: GTS’s CP/CPS (Section 4.2.1) states “Completed validations and supporting evidence may be re-used for up to 200 days prior to issuing the Certificate” — but what we observe is a hard boundary at 8 days, not 200 days.