Proto commits in letsencrypt/boulder

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-28

Merge remote-tracking branch 'origin/main' into ezekiel/remove-fqdnsetexists-dead Discarded local generated code to resolve conflicts, as it will just be regenerated for next commit.

2026-07-23

ra/sa: Prevent parallel validation attempts (#8838) Add a new `beganProcessing` column to the authz2 table, which is a replica of the column of the same name in the orders table. Similarly add a new SA gRPC method which sets this column to true, or returns an error if it already has been set to true. The update is done in a transaction to ensure that multiple attempts to update the field don't all succeed. The error is specifically "conflict", so that the WFE will render it with HTTP status code 409. In the RA, call the new SA method before kicking off validation. If it returns an error, bail out. Lock this behavior behind a feature flag to ensure it is not enabled before the necessary database changes have been made. Add an integration test which kicks off two validations simultaneously and ensures that exactly one of them fails with reason "conflict". Fixes https://github.com/letsencrypt/boulder/issues/3036

The documentation is generated from this commit.

Rename Authz IdInt fields to plain Id. (#8893) Renaming the FooInt variants of Authz IDs to plain ID variants is the final stage of #8722 . Fixes https://github.com/letsencrypt/boulder/issues/8722

Supply limit in request, expect affected rows in response.

Merge remote-tracking branch 'origin/main' into ezekiel/sa-revoke-authorization

2026-07-21

Merge branch main into validation-processing

Remove GetRevocationStatus dead code (#8884) This gRPC method has no callers, as it was only used for OCSP.

Rename Authz IdInt field to plain Id.

2026-07-17

Remove sa.FQDNSetExists dead code

Remove GetRevocationStatus dead code

2026-07-16

Remove all string ID fields for Authzs. (#8828) This is Stage 2 for #8722 --------- Co-authored-by: Samantha Frank <hello@entropy.cat>

2026-07-02

Address review feedback: Update retrybackoff usage of authz revocation tests to 1) retry more quickly in the test expecting change, but 2) retry over a longer period of time in the test expecting stability to try to extend beyond the custom context timeout of the RA function. Rename SA gRPC methods to be consistently plural, reflecting their capability.

Correct va proto field reservation comment. Co-authored-by: Samantha Frank <hello@entropy.cat>

Prevent parallel validation attempts

2026-07-01

Rename RevokeAuthorizationFor to RevokeAuthorizationsFor Because it can revoke multiple authorizations. Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

2026-06-30

Remove all string IDs fields for Authzs.

2026-06-23

Add RevokeAuthzsUponRevokeCert feature to RA.

2026-06-15

Add RevokeAuthorizations func to the SA gRPC service.

Add int-type Authz ID proto fields alongside any string-type proto fields (#8754) This is stage one of normalizing Authz ID to be consistently int64-type (#8722). --------- Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

2026-06-05

add boulder-mtca service (#8776) Includes a proto file with a service definition, an entry in startservers.py and consul.hcl, and configs in test/config and test/config-next (since startservers doesn't currently have a nice way for services to start only in config-next, particularly once boulder-ra starts depending on boulder-mtca in CI). Also, fix a problem from #8764: the newly added field in `orders` was `mtcaID` but should have been `mtcLogID`.

2026-05-22

sfe/salesforce: Remove donation call-to-action and Cases support (#8751) Also, obviate the need to complete the proto changes in TODO #8410. These changes, documented in IN-12087, have not yet been applied in Staging or Production. Fixes #8744

2026-05-18

sa: getAuthorizationStatuses checks results (#8726) If this function gets fewer responses than expected, that means some of the authorizations were deleted before their containing order expired (or were never written due to a bug). Error out. Fix a test that fails with this extra check in place.

2026-05-08

admin: Support creating incidents and adding serials (#8740) Add a StorageAuthorityAdmin gRPC service and four admin subcommands that move incident management into the `admin` tool. Register the service only for the admin client and write through a new `incidents_sa_admin` MySQL user; the existing `incidents_sa` user stays SELECT-only. Incidents can impact tens to hundreds of millions of certificates, and operators may load serials from multiple overlapping time spans during the affected window. `admin load-incident-serials` reads serials from a file, fans them out across N workers (default 10), and streams them to the SA in batches of 10,000. The server re-batches at the same threshold and uses `INSERT IGNORE` on insertion, so overlapping bulk loads and within-batch duplicates are idempotent. The remaining subcommands cover CRUD on the incidents table: - `admin create-incident` adds a row and creates the per-incident serials table. - `admin list-incidents` prints each incident's name, enabled state, renewBy, and URL. - `admin update-incident` changes any subset of url, renewBy, and enabled on an incident by name. Fixes #6943

2026-04-22

wip6

2026-04-20

wip5

Update sa/proto/sa.proto Co-authored-by: Aaron Gable <aaron@letsencrypt.org>

2026-04-17

sa: add RegistrationID to FinalizeAuthorization For now this is just passed in and ignored. In the future it will help fill the reusableAuthorizations table.

2026-03-11

Remove sa.Count[Pending|Invalid]Authorizations2 (#8669) These methods were part of the old rate limits system, and therefore no longer have any callers.

2026-02-05

sfe/ra/sa/admin: Prevent lower override requests from reducing limits (#8613) Today, an approved rate‑limit override request that is lower than an existing override would silently replace the stored override, allowing mistaken or malicious requests to reduce limits. The SA now detects lower overrides, skips the update, and returns the existing override in the response. The RA and SFE surface that signal so auto‑approval creates a Zendesk ticket with a private comment describing the existing override, and attempts to import a ticket with a lower override will result in a similar private comment and the ticket being moved to pending. Boulder will not attempt to import approved tickets with a pending status. The admin CLI commands for importing and adding/updating overrides gain a --force flag to override an existing higher limit, and now report “lower than existing” as an error by default. Fixes #8602

2026-02-04

sa: Add GetOrderAuthorizations (#8605) This is a synonym for GetValidOrderAuthorizations2, which was a misnomer (it now returns _all_ authorizations for an order). Fixes #8603

2026-01-21

salesforce: Rename email package and pardot-test-srv (#8523) - Rename email to salesforce - Rename pardot-test-srv to salesforce-test-srv - Continue building pardot-test-srv by copying salesforce-test-srv - Rename email.Exporter gRPC service to salesforce.Exporter - Register and listen for both salesforce.Exporter and legacy email.Exporter services - Allow salesforce.Exporter impl to answer email.Exporter service via an interface adapter/shim Part of #8410

2025-12-04

Store authzIDs directly in order table (#8460) The `orders` table gets a new column `authzs`, containing a protobuf-encoded list of authorization IDs as int64s. Storing this data directly in the `orders` table will allow us to get rid of the `orderToAuthz2` table, which is large (#8451). There's a new feature flag, `StoreAuthzsInOrders`, which controls whether the SA expects the new column to exist. The SA gracefully handles the case where the new column is NULL, by querying the `orderToAuthz2` table. Eventually all valid orders will have a non-NULL `authzs` column and we can remove the fallback. I removed `orderToModel` because it had only one call site, and that call site only used a subset of fields. This avoids having to update `orderToModel` to know about encoding authzs, only to have that code actually go unused in practice.

2025-10-31

sfe: Create Salesforce Case at override request form submission time (#8438)

Merge remote-tracking branch 'origin/main' into salesforce-rest-api-client

2025-10-30

sa: NewOrderAndAuthzs checks that nonzero authzs were provided (#8464) Also document the relevant fields.

2025-10-29

Deprecate NoPendingAuthzReuse flag (#8458)

2025-10-28

sa: NewOrderAndAuthzs checks that nonzero authzs were provided (#8464) Also document the relevant fields.

2025-10-27

sa: document properties of NewOrderAndAuthzs And add a check that some authzs were provided.

Revert unnecessary diff

Cleanups from self review

2025-10-25

Remove RA involvement

The Authzs Are In The Order

2025-10-24

Deprecate NoPendingAuthzReuse flag

2025-10-16

Delete sa.GetMaxExpiration and sa.GetRevokedCerts (#8401) These two SA methods were used only by the crl-updater's temporal (notAfter-based) sharding code. We now exclusively use explicit (CRLDP-based) sharding, and these methods have no callers. Fixes https://github.com/letsencrypt/boulder/issues/8399 Part of https://github.com/letsencrypt/boulder/issues/8322

2025-10-15

Merge branch 'main' into salesforce-rest-api-client

email-exporter: Add Salesforce Cases support

email-exporter: Add Salesforce Cases support

2025-10-10

WIP

2025-10-09

Reland "SA: Stop supporting OCSP status NotReady" (#8430) Reverts https://github.com/letsencrypt/boulder/pull/8429 Relands https://github.com/letsencrypt/boulder/pull/8395 Remove support for the "ocspNotReady" argument in AddPrecertificate requests, and delete the SetCertificateStatusReady gRPC method. All users of this field and method were removed in https://github.com/letsencrypt/boulder/pull/8394. Fixes https://github.com/letsencrypt/boulder/issues/8343

2025-10-03

Revert "Revert "SA: Stop supporting OCSP status NotReady" (#8429)" This reverts commit 30197ca49b6e7ebfdf8a969bd045110e0d859276.

Revert "SA: Stop supporting OCSP status NotReady" (#8429) Reverts https://github.com/letsencrypt/boulder/pull/8395 The reverted change needed to land one release behind https://github.com/letsencrypt/boulder/pull/8394. Unfortunately, the first release which contained 8394 also contained a bug, and had to be rolled back. The next release would contain both 8394 and 8395, which would lead to availability issues during a deploy when non-updated CA instances try to communicate with updated SA instances. Revert 8395 so that the next release can contain only 8394. This change will be followed by a re-land of 8395, after 8394 has been fully and successfully deployed. Part of https://github.com/letsencrypt/boulder/issues/8343

2025-09-30

Merge branch main into rm-sa-methods

SA: Stop supporting OCSP status NotReady (#8395) Remove support for the "ocspNotReady" argument in AddPrecertificate requests, and delete the SetCertificateStatusReady gRPC method. All users of this field and method were removed in https://github.com/letsencrypt/boulder/pull/8394. Fixes https://github.com/letsencrypt/boulder/issues/8343

2025-09-23

Delete sa.GetMaxExpiration

2025-09-22

SA: Stop supporting OCSP status NotReady

2025-09-11

Delete sa.GetMaxExpiration

SA: Stop supporting OCSP status NotReady

Delete akamai-purger (#8352) The akamai-purger service no longer has any callers. Remove the code implementing this service, the tests which cover the service, and the akamai-test-srv API fake. Fixes https://github.com/letsencrypt/boulder/issues/8346

2025-08-20

CA: delete GenerateOCSP method (#8351) Remove the CA.GenerateOCSP method, and all code related to signing OCSP responses. Fixes https://github.com/letsencrypt/boulder/issues/8349

2025-08-19

RA: delete GenerateOCSP method (#8350) Remove the RA.GenerateOCSP gRPC method. This must be completed (and the corresponding production config changes made) before we can remove the underlying CA.GenerateOCSP method. Fixes https://github.com/letsencrypt/boulder/issues/8348

2025-08-14

Delete akamai-purger

2025-08-13

Remove ca.GenerateOCSP

RA: delete GenerateOCSP method

2025-07-08

sa: Change a return type for GetEnabledRateLimitOverrides (#8280) These methods have no callers. Part of https://github.com/letsencrypt/boulder/issues/8165

2025-07-07

sa/proto: Return full override response

2025-07-03

Remove the last vestiges of account contacts (#8247) Remove the concept of an account contact from all of boulder except the WFE. Specifically: - Delete the UpdateRegistrationContact methods from the RA and SA - Remove all understanding of the Contact field from the RA and SA's NewRegistration methods - Remove the Contact field from corepb.Registration to ensure it can never be communicated anywhere Note that this does not remove the Contact field from core.Registration, as that represents an ACME API type, and we're still willing to parse the Contact field from incoming new-account requests. Fixes https://github.com/letsencrypt/boulder/issues/8199

2025-06-30

sa/proto: Return full override response

2025-06-25

Remove all registration contact code paths

2025-06-17

Merge remote-tracking branch 'origin/main' into admin-overrides-in-database

2025-06-14

Remove all registration contact code paths

2025-06-13

identifier: Remove helper funcs from PB identifiers migration (#8236) Remove `ToDNSSlice`, `FromProtoWithDefault`, and `FromProtoSliceWithDefault` now that all their callers are gone. All protobufs but one have migrated from DnsNames to Identifiers. Remove TODOs for the exception, `ValidationRecord`, where an identifier type isn't appropriate and it really only needs a string. Rename `corepb.ValidationRecord.DnsName` to `Hostname` for clarity, to match the corresponding PB's field name. Improve various comments and docs re: IP address identifiers. Depends on #8221 (which removes the last callers) Fixes #8023

2025-06-10

identifier: Remove helper funcs from PB identifiers migration Remove `ToDNSSlice`, `FromProtoWithDefault`, and `FromProtoSliceWithDefault` now that all their callers are gone. All protobufs have migrated from DnsNames to Identifiers. Remove TODOs for the exception, `ValidationRecord`, where an identifier type isn't appropriate and it really only needs a string. Depends on #8221 (which removes the last callers) Fixes #8023

2025-05-30

ra: Allow rate limit overrides to be added/updated (#8218) #8217

2025-05-29

ra: Allow rate limit overrides to be added/updated

2025-05-28

sa/proto: Return full override response

2025-05-27

Replace most uses of net.IP with netip.Addr (#8205) Retain `net.IP` only where we directly work with `x509.Certificate` and friends. Fixes #5925 Depends on #8196

2025-05-22

sa/proto: Return full override response

Replace most uses of net.IP with netip.Addr Retain `net.IP` only where we directly work with `x509.Certificate` and friends. Fixes #5925 Depends on #8196

2025-05-16

va: Remove deprecated Domain from vapb.IsCAAValidRequest (#8193) Part of #8023

Remove deprecated Domain from vapb.IsCAAValidRequest Part of #8023

2025-05-08

sa: Store and manage rate limit overrides in the database (#8142) Add support for managing and querying rate limit overrides in the database. - Add `sa.AddRateLimitOverride` to insert or update a rate limit override. This will be used during Rate Limit Override Portal to commit approved overrides to the database. - Add `sa.DisableRateLimitOverride` and `sa.EnableRateLimitOverride` to toggle override state. These will be used by the `admin` tool. - Add `sa.GetRateLimitOverride` to retrieve a single override by limit enum and bucket key. This will be used by the Rate Limit Portal to prevent duplicate or downgrade requests but allow upgrade requests. - Add `sa.GetEnabledRateLimitOverrides` to stream all currently enabled overrides. This will be used by the rate limit consumers (`wfe` and `ra`) to refresh the overrides in-memory. - Implement test coverage for all new methods.

ra, va: Bypass CAA for IP identifiers & use Identifier in IsCAAValidRequest (#8153) In `vapb.IsCAAValidRequest`, even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `va.DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency. In `ra.checkDCVAndCAA` & `ra.checkAuthorizationsCAA`, bypass CAA checks for IP address identifiers. Part of #7995

2025-05-07

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

ra: Fully support identifiers in NewOrder, PerformValidation & RevokeCertByApplicant (#8139) In `ra.NewOrder`, improve safety of authz reuse logic by making it explicit that only DNS identifiers might be wildcards. Also, now that the conditional statements need to be more complicated, collapse them for brevity. In `vapb.PerformValidationRequest`, remove `DnsName`. In `ra.PerformValidation`, pass an `Identifier` instead of a `DnsName`. In `ra.RevokeCertByApplicant`, check that the requester controls identifiers of all types (not just DNS). Fixes #7995 (the RA now fully supports IP address identifiers, except for rate limits) Fixes #7647 Part of #8023

2025-05-05

Addressing comments.

2025-05-02

Remove DnsName from vapb.PerformValidationRequest

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

2025-05-01

va: Use Identifier in IsCAAValidRequest Even though CAA is only for DNS names, deprecate `Domain` in favour of `Identifier` for consistency. In `DoCAA`, reject attempts to validate CAA for non-DNS identifiers. Rename `identifier` to `ident` inside some VA functions, also for consistency.

Remove DnsName from vapb.PerformValidationRequest

2025-04-24

sa: Rate limit overrides in the database

2025-04-23

sa: Rate limit overrides in the database

2025-04-18

ca: remove capb.IssueCertificateForPrecertificateRequest (#8127) Fixes #8039

2025-04-17

Remove capb.IssueCertificateForPrecertificateRequest

2025-04-11

ca: Remove IssuePrecertificateResponse (#8115) Instead, simply return DER bytes from `issuePrecertificate`, and accept regular parameters to `issueCertificateForPrecertificate` (instead of a proto message). Also, move the lookup of the certificate profile up to `IssueCertificate`, and pass the selected `*certProfileWithId` to both `issuePrecertificate` and `issueCertificateForPrecertificate`. Also, change `issueCertificateForPrecertificate` to just return DER, not a `*corepb.Certificate` (of which most fields were already being ignored).

2025-04-10

sa: Support new identifier types in authz getting funcs (#8104) Refactor `GetAuthorizations2`, `GetValidAuthorizations2` and `GetValidOrderAuthorizations2` to support non-DNS identifier types. Remove the deprecated `DnsNames` field from the `GetAuthorizationsRequest` and `GetValidAuthorizationsRequest` structs. All users of these structs use `Identifier` instead. Fixes #7922 Part of #7311

2025-04-08

core: Remove DnsNames from Order (#8108) Remove the deprecated `DnsNames` field from the `corepb.Order` proto message. All users of this struct use `Identifiers` instead. This unblocks future changes that will require `Order` users to handle different identifier types. Part of #7311

sa: Remove DnsNames from more request protos (#8105) Remove the deprecated `DnsNames` field from the `CountFQDNSetsRequest`, `FQDNSetExistsRequest`, and `GetOrderForNamesRequest` structs. All users of these structs use `Identifier` instead. Part of #7311

sa: Remove DnsNames from NewOrderRequest (#8101) Remove the deprecated `DnsNames` field from the `NewOrderRequest` struct. All users of this struct use `Identifier` instead. Part of #7311

sa: Support IP identifiers in CountInvalidAuthorizations2 (#8098) Remove the deprecated `DnsName` field from the `CountInvalidAuthorizationsRequest` struct. All users of this struct use `Identifier` instead. Part of #7311

ra: Remove DnsNames from NewOrderRequest (#8100) Remove the deprecated `DnsNames` field from the `NewOrderRequest` struct. All users of this struct use `Identifier` instead. Part of #7311