Proto commits in letsencrypt/boulder

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-02

Address review feedback: Update retrybackoff usage of authz revocation tests to 1) retry more quickly in the test expecting change, but 2) retry over a longer period of time in the test expecting stability to try to extend beyond the custom context timeout of the RA function. Rename SA gRPC methods to be consistently plural, reflecting their capability.

Correct va proto field reservation comment. Co-authored-by: Samantha Frank <hello@entropy.cat>

Prevent parallel validation attempts

2026-07-01

Rename RevokeAuthorizationFor to RevokeAuthorizationsFor Because it can revoke multiple authorizations. Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

2026-06-30

Remove all string IDs fields for Authzs.

2026-06-23

Add RevokeAuthzsUponRevokeCert feature to RA.

2026-06-15

Add RevokeAuthorizations func to the SA gRPC service.

Add int-type Authz ID proto fields alongside any string-type proto fields (#8754) This is stage one of normalizing Authz ID to be consistently int64-type (#8722). --------- Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

The documentation is generated from this commit.

2026-06-05

add boulder-mtca service (#8776) Includes a proto file with a service definition, an entry in startservers.py and consul.hcl, and configs in test/config and test/config-next (since startservers doesn't currently have a nice way for services to start only in config-next, particularly once boulder-ra starts depending on boulder-mtca in CI). Also, fix a problem from #8764: the newly added field in `orders` was `mtcaID` but should have been `mtcLogID`.

2026-05-22

sfe/salesforce: Remove donation call-to-action and Cases support (#8751) Also, obviate the need to complete the proto changes in TODO #8410. These changes, documented in IN-12087, have not yet been applied in Staging or Production. Fixes #8744

2026-05-18

sa: getAuthorizationStatuses checks results (#8726) If this function gets fewer responses than expected, that means some of the authorizations were deleted before their containing order expired (or were never written due to a bug). Error out. Fix a test that fails with this extra check in place.

2026-05-08

admin: Support creating incidents and adding serials (#8740) Add a StorageAuthorityAdmin gRPC service and four admin subcommands that move incident management into the `admin` tool. Register the service only for the admin client and write through a new `incidents_sa_admin` MySQL user; the existing `incidents_sa` user stays SELECT-only. Incidents can impact tens to hundreds of millions of certificates, and operators may load serials from multiple overlapping time spans during the affected window. `admin load-incident-serials` reads serials from a file, fans them out across N workers (default 10), and streams them to the SA in batches of 10,000. The server re-batches at the same threshold and uses `INSERT IGNORE` on insertion, so overlapping bulk loads and within-batch duplicates are idempotent. The remaining subcommands cover CRUD on the incidents table: - `admin create-incident` adds a row and creates the per-incident serials table. - `admin list-incidents` prints each incident's name, enabled state, renewBy, and URL. - `admin update-incident` changes any subset of url, renewBy, and enabled on an incident by name. Fixes #6943

2026-04-22

wip6

2026-04-20

wip5

Update sa/proto/sa.proto Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

2026-04-17

sa: add RegistrationID to FinalizeAuthorization For now this is just passed in and ignored. In the future it will help fill the reusableAuthorizations table.

2026-03-11

Remove sa.Count[Pending|Invalid]Authorizations2 (#8669) These methods were part of the old rate limits system, and therefore no longer have any callers.

2026-02-05

sfe/ra/sa/admin: Prevent lower override requests from reducing limits (#8613) Today, an approved rate‑limit override request that is lower than an existing override would silently replace the stored override, allowing mistaken or malicious requests to reduce limits. The SA now detects lower overrides, skips the update, and returns the existing override in the response. The RA and SFE surface that signal so auto‑approval creates a Zendesk ticket with a private comment describing the existing override, and attempts to import a ticket with a lower override will result in a similar private comment and the ticket being moved to pending. Boulder will not attempt to import approved tickets with a pending status. The admin CLI commands for importing and adding/updating overrides gain a --force flag to override an existing higher limit, and now report “lower than existing” as an error by default. Fixes #8602

2026-02-04

sa: Add GetOrderAuthorizations (#8605) This is a synonym for GetValidOrderAuthorizations2, which was a misnomer (it now returns _all_ authorizations for an order). Fixes #8603

2026-01-21

salesforce: Rename email package and pardot-test-srv (#8523) - Rename email to salesforce - Rename pardot-test-srv to salesforce-test-srv - Continue building pardot-test-srv by copying salesforce-test-srv - Rename email.Exporter gRPC service to salesforce.Exporter - Register and listen for both salesforce.Exporter and legacy email.Exporter services - Allow salesforce.Exporter impl to answer email.Exporter service via an interface adapter/shim Part of #8410

2025-12-04

Store authzIDs directly in order table (#8460) The `orders` table gets a new column `authzs`, containing a protobuf-encoded list of authorization IDs as int64s. Storing this data directly in the `orders` table will allow us to get rid of the `orderToAuthz2` table, which is large (#8451). There's a new feature flag, `StoreAuthzsInOrders`, which controls whether the SA expects the new column to exist. The SA gracefully handles the case where the new column is NULL, by querying the `orderToAuthz2` table. Eventually all valid orders will have a non-NULL `authzs` column and we can remove the fallback. I removed `orderToModel` because it had only one call site, and that call site only used a subset of fields. This avoids having to update `orderToModel` to know about encoding authzs, only to have that code actually go unused in practice.

2025-10-31

sfe: Create Salesforce Case at override request form submission time (#8438)

Merge remote-tracking branch 'origin/main' into salesforce-rest-api-client

2025-10-30

sa: NewOrderAndAuthzs checks that nonzero authzs were provided (#8464) Also document the relevant fields.

2025-10-29

Deprecate NoPendingAuthzReuse flag (#8458)

2025-10-28

sa: NewOrderAndAuthzs checks that nonzero authzs were provided (#8464) Also document the relevant fields.

2025-10-27

sa: document properties of NewOrderAndAuthzs And add a check that some authzs were provided.

Revert unnecessary diff

Cleanups from self review

2025-10-25

Remove RA involvement

The Authzs Are In The Order

2025-10-24

Deprecate NoPendingAuthzReuse flag

2025-10-16

Delete sa.GetMaxExpiration and sa.GetRevokedCerts (#8401) These two SA methods were used only by the crl-updater's temporal (notAfter-based) sharding code. We now exclusively use explicit (CRLDP-based) sharding, and these methods have no callers. Fixes https://github.com/letsencrypt/boulder/issues/8399 Part of https://github.com/letsencrypt/boulder/issues/8322

2025-10-15

Merge branch 'main' into salesforce-rest-api-client

email-exporter: Add Salesforce Cases support

email-exporter: Add Salesforce Cases support

2025-10-10

WIP

2025-10-09

Reland "SA: Stop supporting OCSP status NotReady" (#8430) Reverts https://github.com/letsencrypt/boulder/pull/8429 Relands https://github.com/letsencrypt/boulder/pull/8395 Remove support for the "ocspNotReady" argument in AddPrecertificate requests, and delete the SetCertificateStatusReady gRPC method. All users of this field and method were removed in https://github.com/letsencrypt/boulder/pull/8394. Fixes https://github.com/letsencrypt/boulder/issues/8343

2025-10-03

Revert "Revert "SA: Stop supporting OCSP status NotReady" (#8429)" This reverts commit 30197ca49b6e7ebfdf8a969bd045110e0d859276.

Revert "SA: Stop supporting OCSP status NotReady" (#8429) Reverts https://github.com/letsencrypt/boulder/pull/8395 The reverted change needed to land one release behind https://github.com/letsencrypt/boulder/pull/8394. Unfortunately, the first release which contained 8394 also contained a bug, and had to be rolled back. The next release would contain both 8394 and 8395, which would lead to availability issues during a deploy when non-updated CA instances try to communicate with updated SA instances. Revert 8395 so that the next release can contain only 8394. This change will be followed by a re-land of 8395, after 8394 has been fully and successfully deployed. Part of https://github.com/letsencrypt/boulder/issues/8343

2025-09-30

Merge branch main into rm-sa-methods

SA: Stop supporting OCSP status NotReady (#8395) Remove support for the "ocspNotReady" argument in AddPrecertificate requests, and delete the SetCertificateStatusReady gRPC method. All users of this field and method were removed in https://github.com/letsencrypt/boulder/pull/8394. Fixes https://github.com/letsencrypt/boulder/issues/8343

2025-09-23

Delete sa.GetMaxExpiration

2025-09-22

SA: Stop supporting OCSP status NotReady

2025-09-11

Delete sa.GetMaxExpiration

SA: Stop supporting OCSP status NotReady

Delete akamai-purger (#8352) The akamai-purger service no longer has any callers. Remove the code implementing this service, the tests which cover the service, and the akamai-test-srv API fake. Fixes https://github.com/letsencrypt/boulder/issues/8346

2025-08-20

CA: delete GenerateOCSP method (#8351) Remove the CA.GenerateOCSP method, and all code related to signing OCSP responses. Fixes https://github.com/letsencrypt/boulder/issues/8349

2025-08-19

RA: delete GenerateOCSP method (#8350) Remove the RA.GenerateOCSP gRPC method. This must be completed (and the corresponding production config changes made) before we can remove the underlying CA.GenerateOCSP method. Fixes https://github.com/letsencrypt/boulder/issues/8348

2025-08-14

Delete akamai-purger

2025-08-13

Remove ca.GenerateOCSP

RA: delete GenerateOCSP method

2025-07-08

sa: Change a return type for GetEnabledRateLimitOverrides (#8280) These methods have no callers. Part of https://github.com/letsencrypt/boulder/issues/8165

2025-07-07

sa/proto: Return full override response

2025-07-03

Remove the last vestiges of account contacts (#8247) Remove the concept of an account contact from all of boulder except the WFE. Specifically: - Delete the UpdateRegistrationContact methods from the RA and SA - Remove all understanding of the Contact field from the RA and SA's NewRegistration methods - Remove the Contact field from corepb.Registration to ensure it can never be communicated anywhere Note that this does not remove the Contact field from core.Registration, as that represents an ACME API type, and we're still willing to parse the Contact field from incoming new-account requests. Fixes https://github.com/letsencrypt/boulder/issues/8199

2025-06-30

sa/proto: Return full override response

2025-06-25

Remove all registration contact code paths

2025-06-17

Merge remote-tracking branch 'origin/main' into admin-overrides-in-database

2025-06-14

Remove all registration contact code paths

2025-06-13

identifier: Remove helper funcs from PB identifiers migration (#8236) Remove `ToDNSSlice`, `FromProtoWithDefault`, and `FromProtoSliceWithDefault` now that all their callers are gone. All protobufs but one have migrated from DnsNames to Identifiers. Remove TODOs for the exception, `ValidationRecord`, where an identifier type isn't appropriate and it really only needs a string. Rename `corepb.ValidationRecord.DnsName` to `Hostname` for clarity, to match the corresponding PB's field name. Improve various comments and docs re: IP address identifiers. Depends on #8221 (which removes the last callers) Fixes #8023

2025-06-10

identifier: Remove helper funcs from PB identifiers migration Remove `ToDNSSlice`, `FromProtoWithDefault`, and `FromProtoSliceWithDefault` now that all their callers are gone. All protobufs have migrated from DnsNames to Identifiers. Remove TODOs for the exception, `ValidationRecord`, where an identifier type isn't appropriate and it really only needs a string. Depends on #8221 (which removes the last callers) Fixes #8023

2025-05-30

ra: Allow rate limit overrides to be added/updated (#8218) #8217

2025-05-29

ra: Allow rate limit overrides to be added/updated

2025-05-28

sa/proto: Return full override response

2025-05-27

Replace most uses of net.IP with netip.Addr (#8205) Retain `net.IP` only where we directly work with `x509.Certificate` and friends. Fixes #5925 Depends on #8196

2025-05-22

sa/proto: Return full override response

Replace most uses of net.IP with netip.Addr Retain `net.IP` only where we directly work with `x509.Certificate` and friends. Fixes #5925 Depends on #8196

2025-05-16

va: Remove deprecated Domain from vapb.IsCAAValidRequest (#8193) Part of #8023

Remove deprecated Domain from vapb.IsCAAValidRequest Part of #8023

2025-05-08

sa: Store and manage rate limit overrides in the database (#8142) Add support for managing and querying rate limit overrides in the database. - Add `sa.AddRateLimitOverride` to insert or update a rate limit override. This will be used during Rate Limit Override Portal to commit approved overrides to the database. - Add `sa.DisableRateLimitOverride` and `sa.EnableRateLimitOverride` to toggle override state. These will be used by the `admin` tool. - Add `sa.GetRateLimitOverride` to retrieve a single override by limit enum and bucket key. This will be used by the Rate Limit Portal to prevent duplicate or downgrade requests but allow upgrade requests. - Add `sa.GetEnabledRateLimitOverrides` to stream all currently enabled overrides. This will be used by the rate limit consumers (`wfe` and `ra`) to refresh the overrides in-memory. - Implement test coverage for all new methods.

ra, va: Bypass CAA for IP identifiers & use Identifier in IsCAAValidRequest (#8153) In `vapb.IsCAAValidRequest`, even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `va.DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency. In `ra.checkDCVAndCAA` & `ra.checkAuthorizationsCAA`, bypass CAA checks for IP address identifiers. Part of #7995

2025-05-07

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

ra: Fully support identifiers in NewOrder, PerformValidation & RevokeCertByApplicant (#8139) In `ra.NewOrder`, improve safety of authz reuse logic by making it explicit that only DNS identifiers might be wildcards. Also, now that the conditional statements need to be more complicated, collapse them for brevity. In `vapb.PerformValidationRequest`, remove `DnsName`. In `ra.PerformValidation`, pass an `Identifier` instead of a `DnsName`. In `ra.RevokeCertByApplicant`, check that the requester controls identifiers of all types (not just DNS). Fixes #7995 (the RA now fully supports IP address identifiers, except for rate limits) Fixes #7647 Part of #8023

2025-05-05

Addressing comments.

2025-05-02

Remove DnsName from vapb.PerformValidationRequest

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

2025-05-01

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

Remove DnsName from vapb.PerformValidationRequest

2025-04-24

sa: Rate limit overrides in the database

2025-04-23

sa: Rate limit overrides in the database

2025-04-18

ca: remove capb.IssueCertificateForPrecertificateRequest (#8127) Fixes #8039

2025-04-17

Remove capb.IssueCertificateForPrecertificateRequest

2025-04-11

ca: Remove IssuePrecertificateResponse (#8115) Instead, simply return DER bytes from `issuePrecertificate`, and accept regular parameters to `issueCertificateForPrecertificate` (instead of a proto message). Also, move the lookup of the certificate profile up to `IssueCertificate`, and pass the selected `*certProfileWithId` to both `issuePrecertificate` and `issueCertificateForPrecertificate`. Also, change `issueCertificateForPrecertificate` to just return DER, not a `*corepb.Certificate` (of which most fields were already being ignored).

2025-04-10

sa: Support new identifier types in authz getting funcs (#8104) Refactor `GetAuthorizations2`, `GetValidAuthorizations2` and `GetValidOrderAuthorizations2` to support non-DNS identifier types. Remove the deprecated `DnsNames` field from the `GetAuthorizationsRequest` and `GetValidAuthorizationsRequest` structs. All users of these structs use `Identifier` instead. Fixes #7922 Part of #7311

2025-04-08

core: Remove DnsNames from Order (#8108) Remove the deprecated `DnsNames` field from the `corepb.Order` proto message. All users of this struct use `Identifiers` instead. This unblocks future changes that will require `Order` users to handle different identifier types. Part of #7311

sa: Remove DnsNames from more request protos (#8105) Remove the deprecated `DnsNames` field from the `CountFQDNSetsRequest`, `FQDNSetExistsRequest`, and `GetOrderForNamesRequest` structs. All users of these structs use `Identifier` instead. Part of #7311

sa: Remove DnsNames from NewOrderRequest (#8101) Remove the deprecated `DnsNames` field from the `NewOrderRequest` struct. All users of this struct use `Identifier` instead. Part of #7311

sa: Support IP identifiers in CountInvalidAuthorizations2 (#8098) Remove the deprecated `DnsName` field from the `CountInvalidAuthorizationsRequest` struct. All users of this struct use `Identifier` instead. Part of #7311

ra: Remove DnsNames from NewOrderRequest (#8100) Remove the deprecated `DnsNames` field from the `NewOrderRequest` struct. All users of this struct use `Identifier` instead. Part of #7311

2025-04-07

core: Remove DnsName from Authorization (#8097) Remove the deprecated `DnsName` field from the core `Authorization` struct. All users of this struct use `Identifier` instead. This unblocks future changes that will require `Authorization` users to handle different identifier types. Part of #7311

2025-04-03

ca: unexport IssuePrecertificate and IssueCertificateForPrecertificate (#8092) These methods are still preserved as-is for now, and still take proto messages as arguments. But they are not exported as RPCs. Refactoring the arguments will be a followup PR. Part of #8039

2025-03-26

Add Identifiers to Authorization & Order structs (#7961) Add `identifier` fields, which will soon replace the `dnsName` fields, to: - `corepb.Authorization` - `corepb.Order` - `rapb.NewOrderRequest` - `sapb.CountFQDNSetsRequest` - `sapb.CountInvalidAuthorizationsRequest` - `sapb.FQDNSetExistsRequest` - `sapb.GetAuthorizationsRequest` - `sapb.GetOrderForNamesRequest` - `sapb.GetValidAuthorizationsRequest` - `sapb.NewOrderRequest` Populate these `identifier` fields in every function that creates instances of these structs. Use these `identifier` fields instead of `dnsName` fields (at least preferentially) in every function that uses these structs. When crossing component boundaries, don't assume they'll be present, for deployability's sake. Deployability note: Mismatched `cert-checker` and `sa` versions will be incompatible because of a type change in the arguments to `sa.SelectAuthzsMatchingIssuance`. Part of #7311

2025-03-14

Return updated account object on DeactivateRegistration path (#8060) Update the SA to re-query the database for the updated account after deactivating it, and return this to the RA. Update the RA to pass this value through to the WFE. Update the WFE to return this value, rather than locally modifying the pre-deactivation account object, if it gets one (for deployability). Also remove the RA's requirement that the request object specify its current status so that the request can be trimmed down to just an ID. This proto change is backwards-compatible because the new DeactivateRegistrationRequest's registrationID field has the same type (int64) and field number (1) as corepb.Registration's id field. Part of https://github.com/letsencrypt/boulder/issues/5554

2025-03-12

ARI: Store and reflect optional "replaces" value for Orders (#8056) - Plumb the "replaces" value from the WFE through to the SA via the RA - Store validated "replaces" value for new orders in the orders table - Reflect the stored "replaces" value to subscribers in the order object - Reorder CertificateProfileName before Replaces/ReplacesSerial in RA and SA protos for consistency Fixes #8034

2025-03-06

va: Support IP address identifiers (#8020) Add an `identifier` field to the `va.PerformValidationRequest` proto, which will soon replace its `dnsName` field. Accept and prefer the `identifier` field in every VA function that uses this struct. Don't (yet) assume it will be present. Throughout the VA, accept and handle the IP address identifier type. Handling is similar to DNS names, except that `getAddrs` is not called, and consider that: - IPs are represented in a different field in the `x509.Certificate` struct. - IPs must be presented as reverse DNS (`.arpa`) names in SNI for [TLS-ALPN-01 challenge requests](https://datatracker.ietf.org/doc/html/rfc8738#name-tls-with-application-layer-). - IPv6 addresses are enclosed in square brackets when composing or parsing URLs. For HTTP-01 challenges, accept redirects to bare IP addresses, which were previously rejected. Fixes #2706 Part of #7311

2025-03-05

email/exporter: Add email.Exporter gRPC service (#8017) Initial implementation of the email.Exporter gRPC service to be used by the new cmd/email-exporter. Part of #7966

2025-03-03

va/ra: Deprecate EnforceMultiCAA and EnforceMPIC (#8025) Replace DCV and CAA checks (PerformValidation and IsCAAValid) in va/va.go and va/caa.go with their MPIC compliant counterparts (DoDCV and DoCAA) in va/vampic.go. Deprecate EnforceMultiCAA and EnforceMPIC and default code paths as though they are both true. Require that RIR and Perspective be set for primary and remote VAs. Fixes #7965 Fixes #7819

2025-02-24

ca: unsplit issuance flow (#8014) Add a new RPC to the CA: `IssueCertificate` covers issuance of both the precertificate and the final certificate. In between, it calls out to the RA's new method `GetSCTs`. The RA calls the new `CA.IssueCertificate` if the `UnsplitIssuance` feature flag is true. The RA had a metric that counted certificates by profile name and hash. Since the RA doesn't receive a profile hash in the new flow, simply record the total number of issuances. Fixes https://github.com/letsencrypt/boulder/issues/7983

2025-02-19

Prospect(s) -> Contact(s)

2025-02-14

Merge remote-tracking branch 'origin/main' into add-email-exporter